Permissions
Permissions is a second, independent safety layer on top of mode selection. Where PLAN and BUILD control which tools exist at all, Permissions control what happens each time BUILD actually tries to use one - per tool, not just per mode.
Allow
The action runs immediately, with no interruption.
Ask
GBAM pauses and shows a confirmation prompt in the terminal before running the action.
Deny
The action is blocked. The agent receives an error explaining it was not permitted and continues the conversation without running it.
Responding to a prompt
When GBAM asks for confirmation, you have three choices: allow it once, deny it, or choose "Always" to allow it for the rest of the current session. "Always" is scoped to that exact action - approving one specific file edit or shell command does not automatically approve a different file or a different command; each distinct action is remembered separately.
Protected paths
Certain sensitive paths - such as environment files and version control internals - always require confirmation, regardless of your other rules. You can add your own custom protected paths from the dashboard for extra caution on files specific to your project.
Managing your rules
Set default Allow/Ask/Deny rules per tool category, and manage protected paths, from the Permissions page on your dashboard. Changes take effect on your very next message - no need to restart the CLI.