Nothing changes on disk until you say so.
Chat cannot write files by itself. Every edit and every command an agent proposes goes through the same permission gate before it touches your machine, and for file operations that gate shows you a real diff, not a description of one.
Found the refresh path. Updating the session helper now.
- Fs.read app/auth/session.ts
- Fs.read app/auth/refresh.ts
- Fs.grep app/auth
- Fs.write app/auth/session.ts
Ask ML.ai... @ to delegate
How it works
Every edit and command routes through one gate: Allow, Always, or Deny. A native diff opens before you decide, and a denial is passed back to the model with its reason.
See the diff before you approve
For edit and write operations, a native VS Code diff opens before the permission card is even answered. You approve a change you have looked at, not a summary of it.
Allow, Always, or Deny
Allow permits this one occurrence. Always saves a rule so matching operations stop asking from now on. Deny rejects it, and that specific path is not retried through another tool.
A denial is informative, not silent
When you deny an operation, the reason goes back to the model, letting it retry with something smaller or different instead of attempting the same denied thing again.
Revert is a reviewed operation, not an undo button
Requesting a revert stages it first, binds the preview to the snapshot taken at the time of the original change, and won’t write anything back to disk until you have opened that diff.
The Always risk, and how to check it
You’re working in a scratch folder
Not a Git repository, just a loose folder you opened to try something. ML.ai proposes a write, and a permission card appears.
You click Always
In a non-git workspace, that rule is saved globally: across every folder you open on that machine, not just this one. A single click here can silently stop ML.ai from ever prompting again anywhere else non-git.
Approvals stop appearing, elsewhere
Days later, in an unrelated non-git folder, an operation that should have prompted just runs. This is that same global rule firing again, not a bug.
You check the saved-permissions list
Every saved rule appears there individually and can be revoked on its own. This list is hidden entirely when there are none, so it only shows up once you have something to review.
This rule saves globally, across every non-git folder on this machine, not just this one.
Worth knowing
Shell commands and MCP tool calls show their command or input instead of a diff, since ML.ai cannot know in advance what an arbitrary command or third-party tool will actually change on disk.
In a workspace that is not a Git repository, an Always rule is saved globally, across every non-git folder you open on that machine, not just the current one. Every saved rule can be reviewed and revoked individually from the saved-permissions list.
Revert only ever touches file contents. It never rewrites the conversation transcript itself.
Questions worth asking
Related
Command safety classifier
Every shell command is lexed and classified by effect before it runs. Reads never prompt, writes and higher-risk effects do, and a short list of absolute refusals holds regardless of mode.
Read moreAgents
Choose a subagent for the composer and it stays selected until you remove or replace it. Each one is built for a different kind of work, and only general carries out changes end to end.
Read moreTry ML.ai Code today, or talk to us about what is next.
Install the editor agent on your own machine, or book a call to talk through your team's workloads.