Permission policies
Grounded in permission-policies.md: always_allow vs always_ask, per-toolset defaults, per-tool overrides. See also invocation controls, a distinct claude-tag-grounded primitive for who may invoke anything at all.
agent_toolset_20260401
If default_config is omitted entirely, the agent toolset is enabled with always_allow.
source: permission-policies.md
bash (via configs[])
The configs array overrides the toolset default for one named tool — example: allow the toolset by default but require confirmation before bash specifically.
source: permission-policies.md
custom_tool
Custom tools are executed by your own application, not the server — permission policies do not apply. Your app receives agent.custom_tool_use and decides itself.
source: permission-policies.md
mcp_toolset
MCP toolsets default to always_ask so new tools an MCP server adds later cannot execute without approval.
source: permission-policies.md