14. Permissions and Safe Agent Design

14.1 Why permissions matter

An AI coding agent may have access to powerful actions.

Examples:

• Read files
• Edit files
• Run shell commands
• Search web
• Launch subagents
• Load skills
• Access external directories

Permissions provide control over these actions.

14.2 Permission levels

The current OpenCode documentation describes:

• allow — permit the operation
• ask — request approval
• deny — block the operation

14.3 Least privilege

Give each agent only what it needs.

Example:

Reviewer
 |
 +--> Read: allow
 +--> Search: allow
 +--> Edit: deny

Testing agent:

Tester
 |
 +--> Read: allow
 +--> Run tests: allow/ask
 +--> Edit: deny

Developer:

Developer
 |
 +--> Read: allow
 +--> Edit: allow
 +--> Test commands: allow/ask
 +--> Git push: deny or ask

14.4 Example agent permissions

---
description: Read-only code reviewer
mode: subagent
permission:
  edit: deny
  bash: deny
---

The exact permission keys and syntax should be checked against the current OpenCode documentation/version.

14.5 Command-specific permissions

OpenCode documents fine-grained permission patterns for shell/bash commands.

For example, you may want:

git status -> allow
git diff   -> allow
git commit -> ask
git push   -> deny

This is safer than giving every shell command unrestricted access.

14.6 Dangerous operations

Use approval or blocking for operations such as:

Production deployment
Database deletion
Credential changes
Git push
Infrastructure destruction
Mass file deletion

14.7 Safe workflow

Explore
  |
  v
Plan
  |
  v
Approve
  |
  v
Implement
  |
  v
Test
  |
  v
Review
  |
  v
Human approval

Exercise

Create a permission matrix: