Permission Profiles

Overview

Permission profiles define default approval rules that are merged into the active permission set on startup. They let you declare — once — which operations an agent can run freely, which require confirmation, and which are always denied.

Permission modes

Mode	Behavior
`suggest`	Agent proposes actions; user confirms each one
`ask`	Agent asks before executing potentially destructive actions
`dontAsk`	Agent executes without confirmation (use with care)

Defining a profile

gizzi config profile add strict \
  --rule bash=ask \
  --rule edit=ask \
  --rule delete=deny

Rules are matched in order. The first matching rule wins.

Rule syntax

Each rule is tool=mode:

Tool pattern	Examples
`bash`	Shell command execution
`edit`	File edits via `str_replace_editor`
`delete`	File deletion
`web_search`	Web search
`code_execution`	Sandbox code execution
`*`	Wildcard — matches all tools

Listing profiles

gizzi config profile list

Activating a profile

gizzi config profile set-active strict

Combining with config.toml

Profiles defined via CLI are persisted in config.toml under [permissions.profiles]:

[permissions.profiles.strict]
rules = [
  { tool = "bash", mode = "ask" },
  { tool = "edit", mode = "ask" },
  { tool = "delete", mode = "deny" },
]

CI usage

In CI pipelines, use dontAsk with a restricted tool allowlist:

gizzi exec --permission-profile ci-safe "Run the linter and fix issues"

Where ci-safe only allows bash (for the linter) and edit, denying everything else.

Get Started

Core Concepts

Gizzi Code CLI

Tools & ACI

Security & Enterprise

Admin API

BYOC Runtime

Surfaces

CI CD

Guides

Cookbooks

Release Notes

Overview

Permission modes

Defining a profile

Rule syntax

Listing profiles

Activating a profile

Combining with config.toml

CI usage

​Overview

​Permission modes

​Defining a profile

​Rule syntax

​Listing profiles

​Activating a profile

​Combining with config.toml

​CI usage

Overview

Permission modes

Defining a profile

Rule syntax

Listing profiles

Activating a profile

Combining with config.toml

CI usage