Tools and permissions
The agent can do more than answer questions. With access to your project, it can inspect files, search for information, make changes, run commands, and keep track of useful project context. These tools let it investigate a task and carry out the work instead of only describing what you could do yourself.
What the agent can do
Explore your project
The agent can:
- Read files, including selected sections of large files.
- List the files and folders in your project.
- Search across project files for text or patterns.
These are read-only activities, so they do not change your project and do not need an approval prompt.
Make changes
When you ask the agent to work on your project, it can:
- Edit part of an existing file.
- Create a new file or replace the contents of an existing file.
- Update project or general notes that help it remember useful context in future conversations.
- Create named Actions for commands you use regularly.
Before a change is made, the app shows you what the agent wants to change, including a readable before-and-after view for file edits. You can review it before deciding whether to approve it.
Run commands
The agent can run a command in your project to inspect its output, perform a task, or check its work. Commands run for a limited time and the result is returned to the conversation.
You can also create named Actions for recurring commands, such as starting a development server. Creating an Action requires approval. Once you have approved and created it, the agent can start, stop, and check that Action without asking you to approve the same predefined command every time.
For longer-running work, see terminal.md.
Work with additional agent help
When available, the agent can delegate separate pieces of work to background sub-agents. It can then show you which sub-agents are running and read their results. Any actions those sub-agents want to take are still subject to the permission rules.
For more about this, see agent-chat.md.
Plan and track work on the board
The agent can read and change the project’s board: list tasks and epics, read a task, add tasks (several at once, creating any epic they name), change a task’s fields or status, and start a task. Ask it to “plan this as tasks” or “add a task for …” and the tasks show up on the board; it can also give each task the agent, model, thinking level and permission it should start with. In a task’s own chat it can update that task without naming it, and is asked to move it to Review when its work is done. It can also message the project chat from a task’s chat, or a task from the project chat — see The project chat and task chats.
These don’t need an approval prompt: they change the board, not your files. Moving a task to Done removes its worktree, so the agent can only do that when nothing would be lost; otherwise it’s left for you.
Use project skills
Projects may provide optional skills with specialized instructions. The agent can load one when it is relevant to your request. Skills add guidance for a particular kind of work; they do not bypass the app’s permission controls.
For more about skills and remembered context, see context-and-memory.md.
How the agent knows which tool to use
You don’t need to tell the agent to use its tools. AI Leash tells the agent it
is running inside a harness that shows its work in the UI, so it should use
the harness’s tools, which you can see and review, rather than doing things
out of sight. Every conversation starts with built-in guidance about when to
reach for each one: look through the
project before answering, run long-lived commands such as a development
server as an Action instead of a one-off command, save lasting preferences to
memory when you state them, split independent parts of a request across
sub-agents, and put planned work on the board as tasks. The agent is also shown which Actions and skills already exist, so it can
reuse them without having to look them up first. Your own AGENTS.md
instructions are added after this guidance, so they can refine or override it.
External agents connected over ACP get the same kind of guidance for the AI
Leash tools they can reach (Actions, memory, sub-agents and the board) when they
connect, along with the Actions and skills that exist at that point (they can
call list_actions for the current set), including a preference for those over their own built-in equivalents
so the work shows up in the app. They keep their own tools for files and
commands.
Why permission prompts appear
Some actions can change files, alter project settings, or execute commands. Those actions may have consequences beyond the current conversation, so the app asks for your approval before allowing them.
In Ask mode, you receive a prompt whenever the agent requests permission for an action that needs it. The prompt explains what the agent wants to do:
- For a file change, you can review the proposed additions, removals, and surrounding unchanged lines.
- For a command, you can read the command before it runs.
- For another approved operation, you can review the description shown by the prompt.
The agent waits for your decision. Nothing is changed or run until you approve it.
Your choices
When a prompt appears, choose:
- Approve to allow that specific request.
- Deny to block it. The agent is told that you denied the request and can adjust its approach or ask what you would prefer.
There is no separate “always allow this action” choice on an individual prompt. In Ask mode, later file changes and commands produce their own prompts, so you remain involved in each approval.
The permission control beside the chat input also lets you choose:
- Ask — show a prompt before every action that needs approval. This is the default and gives you the most oversight.
- Bypass — automatically approve permission requests for the current conversation, without showing prompts. Use this only when you are comfortable letting the agent carry out those actions on your behalf. You can switch back to Ask at any time.
Read-only exploration does not require permission in either mode. Actions that you have already defined are also treated as pre-approved when the agent starts or stops them.
Staying in control
The agent works within the project you opened, and permission prompts give you a chance to inspect consequential actions before they happen. You can keep Ask mode enabled while reviewing changes one at a time, deny anything that does not match your intent, or use Bypass for a conversation where you want the agent to work with fewer interruptions.
If you are unsure what a proposed command or change will do, deny it and ask the agent to explain or take a safer, smaller step.