# Modes and permissions

> Control whether an agent plans, edits, runs commands, or asks first.

Canonical URL: https://docs.zuse.sh/composer/modes-permissions



Zuse has two related controls: **Plan mode** decides whether the agent may implement, while the **runtime permission mode** decides which actions can proceed without asking.

## Plan mode [#plan-mode]

Plan mode is read-only. The agent can inspect and reason about the project, then proposes a plan. Mutating tools remain blocked even if the runtime permission mode is **Full access**. Approving or leaving the plan returns the session to normal execution.

Use Plan mode when the implementation shape, scope, or tradeoff is not yet settled. Use normal execution when the desired result is already decision-complete.

## Runtime permission modes [#runtime-permission-modes]

| Mode                          | Automatically allowed                                   | Still asks                                       |
| ----------------------------- | ------------------------------------------------------- | ------------------------------------------------ |
| **Ask for approval** (locked) | Read-only tools                                         | Bash, edits, web requests, MCP and other tools   |
| **Approve for me**            | Actions approved by the provider's native safety review | Actions the provider escalates for your decision |
| **Full access**               | Ordinary tools                                          | Plan-mode exits and sensitive paths              |

Approve for me uses native automatic review in compatible Codex, Claude, and Grok installations. Grok requires its native Auto-mode feature to be enabled; when disabled, Grok asks for approval. Other providers ask for approval when this mode is inherited from a default. A provider that cannot start automatic review reports an error; Zuse does not silently grant Full access.

Changing access stops the current turn and retires the old provider runtime. Your next message resumes the conversation with the selected mode. This also ensures locking a previously unrestricted session takes effect.

Existing sessions saved with Auto-accept edits or Auto-accept edits + Bash retain their behavior until you choose a new mode. Those legacy modes are no longer offered for new selections.

Full access uses the provider's unrestricted execution mode. Zuse-owned sensitive-path approval gates and read-only Plan mode still apply; Full access is not a sandbox.

## Permission prompts [#permission-prompts]

When an action needs approval, Zuse places the request at the composer with its operation and context. Approve only after the target and consequence are clear. Denying a request returns control to the agent so it can explain, adjust, or choose another approach.

The permission inspector records decisions and exposes applicable controls. Session overrides affect the active session; default permission mode is configured globally or by repository.

## Slash commands [#slash-commands]

Use `/plan` to enter Plan mode and `/run` to return to normal execution. `/mode <name>` changes the runtime posture. The command picker also includes provider-specific commands only when they apply to the selected provider.