A permission mode controls how much the agent does on its own and when it stops to ask you.
The mode is set per thread, from the mode control in the message composer. Changing it in one thread does not change any other thread. A thread created from inside another thread keeps that thread's mode; otherwise new threads start in Full access unless you pick something else before sending.
Supervised: ask before commands and file changes. The agent pauses and shows you what it wants to run or edit, and waits for approval. Work outside the workspace is restricted.
Auto-accept edits: auto-approve edits, ask before other actions. File changes go through without prompting; commands and anything else still stop for approval.
Auto: routine actions proceed without you; risky ones still ask. How this is enforced depends on the provider: Codex delegates routine approvals to an AI reviewer, Claude uses its own auto permission mode, and providers without an equivalent (such as OpenCode) fall back to asking, like Supervised.
Full access: allow commands and edits without prompts. The default. The agent runs unattended until it finishes or asks a question of its own.
Approvals appear inline in the conversation. Approve or reject one and the agent continues from there.
Use Full access for work in a worktree or a sandbox you can throw away.
Use Supervised on a repository where an unwanted command is expensive, or the first time you run an unfamiliar task.
Auto-accept edits suits refactors where the edits are the point and you only care about the shell commands.
Each provider maps these modes onto its own approval and sandbox settings. Codex, for example, translates the mode into its approval policy and sandbox level, so Supervised runs the CLI with prompting enabled and a restricted workspace while Full access disables both. The labels above describe what you get; the exact per-provider translation is internal and may change.
Mobile offers the same four modes. It labels the first one Approve actions rather than Supervised.