ML.ai CodeControl & Safety

Permission prompts

How Allow, Always, and Deny work, and the global-scope risk to know about before clicking Always.

When the agent wants to do something that needs your say-so, a permission card appears next to that operation, with three choices.

ML.ai

Found the refresh path. Updating the session helper now.

Working · 3 operations completed
  • Fs.read app/auth/session.ts
  • Fs.read app/auth/refresh.ts
  • Fs.grep app/auth
  • Fs.write app/auth/session.ts
Permission required
AllowAlwaysDeny
medium

Ask ML.ai... @ to delegate

BuildML.ai StandardAsk
Awaiting approval
Permission required, inline in the activity log next to the gated operation
ChoiceEffect
AllowPermits this one occurrence, nothing more
AlwaysSaves a rule; matching operations proceed without asking from now on
DenyRejects this operation; that specific execution path is not retried through a different route

Cards appear one at a time, never as a burst of several at once, even when a turn has multiple pending operations queued up.

Denials are informative, not silent

When you deny an operation, the reason is passed back to the model, not just a bare rejection. This lets it narrow its approach and retry with something smaller or different, instead of attempting the same denied thing again.

The Always risk

In a workspace that is not a Git repository, an Always rule is saved globally: across every folder you open on that machine, not just the current one. A single click in a non-git scratch folder can silently stop ML.ai from ever prompting again anywhere else non-git on that machine. This is the single biggest thing to understand about permission prompts before you click Always.

Mitigation: every saved rule appears in a collapsed "saved permissions" list (hidden entirely when there are none), and each rule can be revoked individually from there. If approvals seem to have stopped appearing unexpectedly, check that list. See troubleshooting.