Docs / Team and security
Auto Mode and Full Access
How the agent asks before risky actions, and the per-conversation switch that lets it run without asking.
Plans let you review significant cloud infrastructure work. They are separate from the permission mode. The permission mode governs single actions, such as running a shell command, editing a file or calling a tool. Not every write gets a plan card, so use provider permissions to enforce a read-only boundary.
Every conversation is in one of two modes. You pick it in the composer's Authorization mode menu:
- Auto Mode: risky commands ask for your approval.
- Full Access: the agent runs every command without asking.
Auto Mode
The agent runtime, such as Claude Code or Codex, decides which actions need permission, using its own permission rules. See Runtimes and computers. When it asks, Pangea does not decide for you. No model judges the action, and there is no list of standing rules. You see the question as an approval card on that step, and the turn waits for your answer.
- The card offers the choices the runtime gives for that action, such as allowing it once or rejecting it.
- If nobody answers within 2 minutes, the request is denied.
- If you send a new message while a request is waiting, that request is cancelled. Your message never gets stuck behind an approval.
- When the agent wants to control an app on a computer through Computer Use, it asks the same way before it takes control of that app.
Full Access
Full Access turns the questions off for one conversation. Pangea approves every permission request the runtime raises. If the runtime offers no way to allow an action, the action is denied.
- One conversation at a time. The switch never carries into another conversation.
- Per person. It applies only to the turns of the person who turned it on. In the app, only the conversation's owner can switch it, so a teammate you invite is still asked. In a Discord thread, any linked team member can switch it for their own turns with
/pangea full-accessor/pangea auto. - It stays on until you turn it off. It does not expire.
- It leaves a trail. Turning it on or off is recorded on the conversation. Every action it allows is marked as allowed because Full Access is on.
Where Full Access is the default
Full Access is the starting point where nobody watches live to approve each step:
- messages sent to the agent from Slack or Discord, for the person who sent them
- conversations started by a trigger or another automation
This default applies only to someone who has no setting in that conversation yet. If you already switched a conversation to Auto Mode, a later message from Slack or Discord keeps it in Auto Mode.
Some turns start from an event in an existing conversation, such as an update to a linked pull request. These don't change the mode. They run in the conversation owner's current mode, which is Auto Mode unless the owner turned on Full Access. With nobody there to answer, their permission requests time out and are denied.
A thread the agent opens starts in its parent conversation's mode. The agent can give a thread Full Access only from a conversation that already has it.
Full Access means the agent can run destructive work without stopping to ask: deleting resources, force-pushing, changing IAM. Turn it on only for conversations where you want that, and switch back to Auto Mode when you are done.
[!TIP] Start in Auto Mode. The approval cards show exactly what the agent wants to do. You can still switch one conversation to Full Access when you need it to move without interruptions.