> ## Documentation Index
> Fetch the complete documentation index at: https://docs.9thprotocol.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> What 9p can do without asking, and how to change it.

9p asks before it changes anything. The permission mode decides how often.

## Modes

| Mode           | Reads   | Edits       | Commands    |
| -------------- | ------- | ----------- | ----------- |
| `default`      | allowed | asks        | asks        |
| `accept-edits` | allowed | allowed     | asks        |
| `plan`         | allowed | **blocked** | **blocked** |
| `bypass`       | allowed | allowed     | allowed     |

Change mid-session:

```
/mode plan
/mode accept-edits
```

### `default`

The starting mode. Reading, searching, and globbing happen freely; every write
and every command prompts:

```
● permission bash: npm test, allow? [y/N]
```

### `accept-edits`

File edits stop prompting; commands still ask. This is the mode to switch to
once you've seen a plan you agree with and just want it executed.

### `plan`

Read-only. 9p investigates and proposes but cannot touch the working tree. Use
it for "what would you change and why", and note that plan mode also tells the
[router](/models) to treat the turn as complex, so you get a stronger model.

### `bypass`

No prompts at all. Appropriate for a scratch repo or a container, not for
anything you care about.

## Guardrails that always apply

These hold in every mode, including `bypass`:

* **Read before write.** `write` and `edit` refuse to touch a file the agent
  hasn't read in this session, so it can't clobber content it never saw.
* **Sub-agent spawning is gated.** Starting a [sub-agent](/sub-agents) is treated
  as an exec-class action, because it's an agent that runs unattended.
* **Sub-agent depth is capped at 2.** Sub-agents cannot recurse indefinitely.
* **Explore sub-agents get read-only tools.** They physically cannot edit.

## Practical advice

<AccordionGroup>
  <Accordion title="Start in plan mode for anything large">
    `/mode plan`, ask for the approach, read it, then switch to `accept-edits`
    and let it run. Catching a wrong plan costs one turn; catching it after 30
    file edits costs a lot more.
  </Accordion>

  <Accordion title="Keep bash gated">
    `accept-edits` is a good default for real work precisely because edits are
    reviewable in git while commands are not.
  </Accordion>

  <Accordion title="Use git as the real safety net">
    Commit before a big task. The permission prompts reduce surprises; a clean
    working tree is what actually lets you undo one.
  </Accordion>
</AccordionGroup>