Permissions

Permissions decide what R-CLI may do without asking you. Read-only work runs freely; anything that changes your machine asks first, unless you have said otherwise.

By default R-CLI starts in Manual mode: it reads files and runs safe commands on its own, and asks before every edit, write, or non-trivial shell command.

​

Permission modes

Press Shift+Tab to cycle modes during a session. The current mode is shown in the status bar.

Set the mode at startup instead:

backboard --permission-mode acceptEdits

An unrecognized value does not stop the run. R-CLI falls back to manual and prints a warning:

Unknown --permission-mode "yolo"; using manual mode. Valid: manual, acceptEdits, auto, bypass.

​

Configuration file

Permission settings live in your project, at the repository root:

<repo-root>/.backboard/settings.json

The repo root is found by walking up from your working directory looking for .git, so every subdirectory of a project shares one policy.

{
  "permissions": {
    "mode": "manual",
    "allow": [
      "execute(git status:*)",
      "execute(bun test:*)",
      "read(src/**)"
    ],
    "deny": [
      "execute(rm:*)",
      "write(.env)"
    ],
    "ask": [
      "execute(git push:*)"
    ]
  }
}

Mode precedence is --permission-mode flag, then permissions.mode, then manual.

​

Rule syntax

A rule is a tool name, optionally followed by a pattern in parentheses:

execute                      # the whole Execute tool
execute(git status:*)        # commands starting with "git status"
write(.env)                  # writing exactly .env
read(src/**)                 # reading anything under src/

Tool names are lower-cased, for example execute, read, write, edit, find_skill, find_mcp.

Patterns are matched against the meaningful part of the call — the command string for execute, the file path for edit and write:

​

How a decision is made

For every tool call, the first matching step wins:

deny and ask are evaluated before the bypass gate on purpose: no mode can skip them. This makes deny a reliable guardrail even in automated runs.

​

Safe commands

Some read-only shell commands are approved automatically without a rule:

git status   git diff   git log   git show
ls   pwd   cat   head   tail   wc   which   echo
grep   rg   find
bun test   bun run typecheck

Read-only forms of git branch are also approved — --list, --show-current, -a, -r, -v, and their combinations.

These are treated as unsafe and will still prompt:

• Anything containing $(, a backtick, >, or <.
• Chained commands where any segment is not itself safe — segments are split on &&, ||, ;, |, &, and newlines.
• find with -exec, -execdir, -ok, -okdir, -delete, -fprint, -fprintf, -fprint0, or -fls.
• rg with --pre, --pre-glob, --hostname-bin, --search-zip, or -z.
• git status, git diff, git log, or git show with --output.
• git branch with anything other than read-only flags such as --list or --show-current. A bare branch name mutates, so it prompts.
• Background commands, which are never auto-approved by the safe list.

Quotes are stripped before the find, rg, and git flag checks, so '-delete' cannot dodge the guard. The $(, backtick, >, and < check runs on the raw command.

​

The permission prompt

When a call needs approval, R-CLI shows the tool, a one-line summary of what it will do, and three choices:

The “always allow” option always shows the exact rule it will save, so you can see how broad it is before accepting.

R-CLI scopes that rule conservatively:

Sensitive commands that never generalize include rm, rmdir, mv, dd, mkfs, ln, chmod, chown, chgrp, curl, wget, kill, killall, pkill, sudo, su, git, docker, ssh, scp, and rsync. Approving rm -rf build once will not allow rm in general.

​

Headless and automation

Non-interactive runs cannot show a prompt, so anything that would ask is denied:

Permission required for Execute — permission prompts are unavailable in this context.

This applies to --print one-shot mode. To script R-CLI, either pre-approve exactly what it needs:

{
  "permissions": {
    "allow": ["execute(bun test:*)", "execute(git diff:*)"],
    "deny": ["execute(git push:*)"]
  }
}

Or, in a disposable environment only:

backboard --print "run the test suite" --permission-mode bypass

​

Sub-agents

Sub-agents inherit the parent session’s mode and rules, but can never prompt. Each of their tool calls is checked individually, and anything that would ask is denied.

Sub-agents also cannot install third-party code. They can call the skill and MCP discovery tools, but those tools refuse to install anything from a sub-agent and report the match back instead. Only the main agent can request an install, and only with your confirmation.

​

Related

• Command reference — the --permission-mode flag and config file locations
• Checkpoints — undo file changes the agent already made
• Skills and discovery — confirmation before installing third-party skills and MCP servers