Approvals & Safety
Bahulam classifies every tool call into a risk tier and decides whether to auto-approve, checkpoint, or prompt you for confirmation. This protects your codebase from accidental damage while keeping you in the loop.
Risk Tiers
Every tool call is assigned one of eight tiers. The tier determines what happens before the tool executes.
| Tier | Behavior | Examples |
|---|---|---|
read | Auto — proceeds silently | read_file, search_code, grep, list_files |
sensitive-read | Prompt required — no default | read_file on .env, *.pem, secrets/** |
local-edit | Auto with checkpoint — proceeds but records undo info | edit_file, write_file, write_project |
shell-safe | Auto — proceeds silently | ls, cat, pwd, git status, npm test |
shell-medium | Prompt safe — Enter to approve | npm install, git add, pip install |
shell-dangerous | Prompt explicit — must type y | rm -rf, chmod, sudo, kill |
destructive | Prompt explicit — must type y | delete_file, rm -rf / |
network | Prompt safe — Enter to approve | curl, wget, git clone, npm publish |
Tier classification happens locally on your machine — the backend never decides what’s dangerous. This means dangerous intent can’t be hidden behind a friendly description.
Approval Prompt
When Bahulam needs your approval, you’ll see a prompt like this:
┌──────────────────────────────────────┐
│ Bahulam wants to run: rm -rf node_modules │
│ │
│ [Enter] approve [y] yes [s] skip │
│ [a] always allow [t] tell me more │
│ [r] reject [n] no [?] help │
└──────────────────────────────────────┘| Key | Action |
|---|---|
Enter | Approve (safe prompts) |
y | Yes, approve |
n | No, reject |
r | Reject permanently |
s | Skip this tool call |
a | Always allow this tool from this agent |
t | Show me more context about what’s happening |
? | Show help for the prompt |
Permission Modes
Set the permission mode with --permission-mode <mode> to control how
strictly Bahulam requires approval.
| Mode | Description |
|---|---|
default | Prompt for anything not pre-approved (safe fallback) |
bypassPermissions | No approval prompts — all tool calls proceed |
acceptEdits | Auto-approve file edits, prompt for shell commands |
plan | Block all write operations — read-only planning mode |
auto | Use tier-based defaults (see risk tiers above) |
dontAsk | Never prompt — reject anything that isn’t auto-approved |
Skipping All Permissions
Two ways to skip approvals — one at launch, one mid-session:
--dangerously-skip-permissions (launch flag) skips all approval prompts
from the moment the CLI starts. Every tool call proceeds without confirmation,
including dangerous tiers. Hard safety blocks still apply.
/auto full (mid-session) does the same thing but at runtime — you can
flip a session into full autopilot after you’ve reviewed the initial plan,
without restarting. Equivalent to --dangerously-skip-permissions for the
rest of the session; /auto off restores prompts.
Both variants are for the same use cases:
- Trusted environment (disposable VM, CI, benchmark)
- Long autonomous run where you’ve reviewed the plan and don’t want to be interrupted by mid-run approval prompts
For interactive sessions where you want routine calls to pass but risky
ones to still prompt, use plain /auto (or /auto on) — it auto-approves
routine tool calls but still prompts for dangerous operations (rm,
force-push, command substitution, protected files).
Three levels at a glance:
| Command | Routine (read/edit/shell-safe) | Dangerous (rm/force-push/protected) | Hard-safety blocks |
|---|---|---|---|
/auto off (default) | prompt / auto-approve per tier | prompt | enforced |
/auto (or /auto on) | auto-approve | still prompt | enforced |
/auto full / --dangerously-skip-permissions | auto-approve | auto-approve | enforced |
Caution: As the name says, /auto full and --dangerously-skip-permissions
disable all safety prompts. Destructive commands like rm -rf will execute
without warning. The CLI’s hard-safety layer still blocks pathological
patterns (e.g. rm -rf /, sudo rm -rf) regardless of approval mode.
Human-in-the-Loop (HITL)
Bahulam supports several HITL patterns beyond the tier system:
/plan/--plan— Start in planning mode. Bahulam analyzes the task and presents a structured plan before any code is written. You can accept, request revisions, or cancel.- Diff preview — Bahulam shows a diff before applying changes, so you can review exactly what will be modified.
/review— Summarize what changed in the current session.- Trust system — When you use
a(always allow), Bahulam trusts that tool from that agent for the session. Use/approvals clearto clear all auto-approvals.
When to Review Carefully
Always review diffs before confirming for:
- File deletions
- Large-scale renames
- Changes to configuration files (
.env,package.json,tsconfig.json) - Dependency updates
- Security-sensitive files (auth, secrets, credentials)
Approval Log
All approval decisions are logged to .bahulam/approvals.log in the project
directory. This file is not git-committed by default.
[2025-03-15T10:32:14Z] APPROVED | write_file | src/app/page.tsx | auto
[2025-03-15T10:32:18Z] APPROVED | shell | npm install | prompt-safe
[2025-03-15T10:32:22Z] REJECTED | shell | rm -rf node_modules | prompt-explicitSensitive Reads
Bahulam treats certain files as sensitive and will prompt for approval before reading them, even though reading is normally auto-approved:
.env,.env.**.pem,*.key,*.certsecrets/**,credentials/**~/.ssh/*,~/.aws/*
Shell Command Classification
Shell commands are classified by their risk:
| Risk | Examples |
|---|---|
| Safe (auto) | ls, cat, pwd, echo, git status, npm test, python --version |
| Medium (prompt-safe) | npm install, git add, git commit, pip install, cargo build |
| Dangerous (prompt-explicit) | rm -rf, chmod -R, sudo, kill, dd, mkfs, >:, | redirects to critical paths |
Related
- Commands → CLI Flags — Full list of permission-related flags
- Getting Good Results → HITL — Best practices for review workflows
- Automation & CI/CD — Headless mode auto-approves all tools