Permission policies control how agents use tools and spend credits — set them to Always allow, Always ask, or Auto.
Policies apply to all agents in a workspace or to a specific agent. A spend-cap rule can also limit how much any agent spends per session.
- Always allow — the agent proceeds without pausing.
- Always ask — the agent pauses and waits for your approval before each action.
- Auto — the agent decides based on context.
Where: Web — workspace settings (URL: /settings). API and CLI support policy rules with sky policy.
Good to know: workspace-level rules apply to all sessions unless a session-level rule overrides them. Spend-cap rules stop a session when it reaches the limit you set. Related: What is a workspace?.