Approval and Security
Approval decides whether the agent asks for your confirmation before acting. LanMate offers four preset modes, from “ask for every change” to “almost fully automatic”—dangerous operations are intercepted in every mode.
Four Approval Modes
| Mode | Behavior |
|---|---|
| Read auto | Read-only commands run directly; file changes and command execution prompt for confirmation |
| Read-write auto (default) | File reads and writes run directly; command execution prompts |
| AI auto | AI assesses command risk: low risk auto-approves, high risk prompts |
| Full access | All commands run directly; dangerous commands are still intercepted |
New tasks default to “read-write auto”—the daily balance: document and code edits never get interrupted, but commands (installing dependencies, running scripts, network requests) ask first.
There are two places to switch:
- In conversation: the mode label at the bottom-left of the input, switchable anytime, affects only the current session
- Settings: Settings → Security → Default approval level, the default for new conversations
Note: Under “full access”, LanMate can execute any command without confirmation—use only in trusted environments. “AI auto” relies on AI judgment and may misjudge risk.
Tool Call Classification
Every tool call is first classified statically (conservative by design: when in doubt, escalate):
| Level | Typical operations | Read auto | Read-write auto | AI auto | Full access |
|---|---|---|---|---|---|
| Read | View files, search, git status |
Auto | Auto | Auto | Auto |
| Write | Edit files, git commit |
Confirm | Auto | AI decides | Auto |
| Execute | Shell commands, network, install | Confirm | Confirm | AI decides | Auto |
| Dangerous | Delete system files, format, etc. | Confirm | Confirm | Confirm | Confirm |
Dangerous operations are a hard guardrail: all four modes force confirmation, and “allow for this session” cannot bypass them.
AI Command Review
Settings → Security → enable “AI command review”, and pending operations go to the review model first:
- Returns
safe/caution/dangerwith a plain-language explanation of what the command does and its possible consequences safeauto-approves;caution/dangerprompt- 8-second timeout or failure falls back to
caution(better a human glance) - The review model reuses the current conversation’s model—no extra configuration
Approval Cards
When confirmation is needed, an approval card appears at the top of the message stream:
- Tool name, risk level, plain-language AI explanation
- Full command text (monospace, scrollable)
- Three choices: Deny / Allow once / Allow for this session
A 10-minute timeout counts as deny. “Allow for this session” is session-scoped—with several sessions in parallel, each decides on its own; dangerous operations ignore session-level grants.
Channel sessions (commanding the agent from Lansenger) push approval cards to Lansenger: four buttons (approve once / allow for this chat / always allow / deny), 660-second expiry counts as deny. See Lansenger Channel.
Scheduled Tasks and Sub-Agents
Unattended scenarios have their own settings:
| Setting | Location | Description |
|---|---|---|
| Scheduled task approval level | Settings → Security | The level for unattended tasks; loosening it a bit avoids blocking |
| Sub-agent approval | Settings → Security | Follow parent (recommended): sub-agent approval cards show in the main chat; fully automatic: routine operations run directly, dangerous ones still confirm |
| Unattended writes | Settings → Security | How scheduled tasks, code review, and sub-agents handle write operations |
Unattended writes, three levels:
| Level | Behavior |
|---|---|
| Default | Execute directly |
| Warn with trail | Execute, record, and flag |
| Force approval | Requires human approval; rejects when no one responds (may fail scheduled tasks) |
Relationship with the Sandbox
Approval governs “whether it asks you”; the sandbox governs “where it can touch”. The two layers act independently—see Sandbox and File Protection.