Approval and Security
Approval decides whether LanMate asks for your confirmation before acting. LanMate controls this with two axes: approval gear (whether it asks) and file protection (where it can write), combined into the permission preset chip. Dangerous operations are intercepted under every configuration.
Permission Presets
The permission preset chip at the bottom-left of the input offers four presets, each a combination of “approval gear × file protection”:
| Preset | Approval gear | File protection | Behavior |
|---|---|---|---|
| Read auto | Auto-approve (AI-judged) | Session temp area only | View-only operations run directly; writes and commands are judged by AI — low risk auto-approved, high risk confirmed |
| Read-write auto (default) | Auto-approve (AI-judged) | Workspace | File reads and writes run automatically; commands are judged by AI — low risk auto-approved, high risk confirmed |
| Auto run | No approval | Workspace | Everything runs automatically; dangerous operations still intercepted |
| Full access | No approval | Unlimited | Everything runs automatically (triggers a red risk confirmation) |
New tasks default to “read-write auto”: document and code edits never get interrupted, but commands (installing dependencies, running scripts, network requests) ask first. For finer control, click the preset chip to expand the custom two-axis picker (4 approval gears × 3 file-protection levels, 12 combinations).
In a fresh session, adjusting the two axes only takes effect as a draft for the current session and doesn’t change the global default. Settings → Security → Default approval level changes the default for new tasks.
Four Approval Gears
| Gear | Behavior |
|---|---|
| No approval (yolo) | Runs automatically (deletion and dangerous operations still force confirmation) |
| Read-write allowed (write) | File reads and writes run automatically; command execution confirms |
| Always ask (ask) | Everything prompts for confirmation |
| Auto-approve (auto) | AI judges risk: low risk auto-approves, high risk confirms |
Three File Protection Levels
| Level | Writable scope |
|---|---|
Read-only (read-only) |
Only the system temp directory is writable; the project working directory is not writable by default. Writes inside the working directory require per-write authorization |
| Workspace (workspace, default) | Project working directory + system temp directory + session artifacts directory |
| Unlimited (full) | Any path |
Note: Under “full access”, LanMate can execute any command without confirmation—use only in trusted environments. Auto-approve relies on AI judgment and may misjudge risk.
Tool Call Classification
Every tool call is first classified statically (conservative by design: when in doubt, escalate):
| Level | Typical operations | Behavior |
|---|---|---|
| Read | View files, search, git status |
Handled per the current approval gear |
| Write | Edit files, git commit |
Handled per the current approval gear |
| Delete | rm, deleting files/directories |
Forces confirmation in every mode (including no-approval); can accept “allow for this session” |
| Dangerous | rm -rf /, fork bombs, mkfs, curl|sh, sudo su, rewriting /etc profiles |
Forces confirmation in every mode; no session-level grant |
Dangerous operations are a hard guardrail: every mode forces confirmation, and “allow for this session” cannot bypass them.
AI Command Review
Once a usable model is configured, AI review turns on automatically (no separate toggle in Settings). Pending operations go to the review model first:
- Returns
safe/caution/dangerwith a plain-language explanation of what the command does and its possible consequences safeauto-approves;caution/dangerprompt- A 20-second timeout or failure falls back to
caution(better a human glance) - The review model reuses the current conversation’s model—no extra configuration
- The plain-language verdict is output in the current UI language
Approval Cards
When confirmation is needed, the approval bar takes over the input (you can’t pre-type the next message while approving):
- Tool name, risk level, plain-language AI explanation
- Full command text (monospace, scrollable)
- Regular operations offer three choices: Deny / Allow once / Allow for this session
- Writes to the project and global memory directories offer only two choices: Allow once / Deny—neither yolo nor session grants can bypass them. Since 2026-11-06, AGENTS.md / CLAUDE.md / RULES.md are handled as ordinary writes: no approval card, just an audit marker recorded in the session
A 10-minute timeout counts as deny. “Allow for this session” is session-scoped—with several sessions in parallel, each decides on its own; dangerous operations ignore session-level grants.
Channel sessions (commanding LanMate from Lansenger) push approval cards to Lansenger: four buttons (approve once / allow for this chat / always allow / deny), 660-second expiry counts as deny. See Lansenger Channel.
Scheduled Tasks and Sub-Agents
Unattended scenarios have their own settings:
| Setting | Location | Description |
|---|---|---|
| Scheduled task approval level | Settings → Security | The gear for unattended tasks; loosening it a bit avoids blocking |
| Unattended writes | Settings → Security | How scheduled tasks, code review, and sub-agents handle write operations |
| Sub-agent approval | Settings → Security | Follow parent (default): sub-agent approval cards show in the main chat; fully automatic: routine operations run directly, dangerous ones still confirm |
Unattended writes, three levels:
| Level | Behavior |
|---|---|
| Default | Execute directly |
| Warn with trail | Execute, record, and flag |
| Force approval | Requires human approval; rejects when no one responds (may fail scheduled tasks) |
Relationship with the Sandbox
Approval governs “whether it asks you”; the sandbox governs “where it can touch”. The two layers act independently—see Sandbox and File Protection.