Permissions
What agents can do without asking you, and what always asks.
A workspace is a git worktree, not a sandbox. Without approvals, agents run with full permissions inside the workspace folder.
Ask before tool calls
Settings → Agents → Ask before tool calls is off by default.
When it is on, Claude Code asks you before each edit and command. The chat shows Allow <tool>? with Allow and Deny. The workspace row shows that it is waiting, and Korev sends a notification.
Codex cannot ask before a tool call. It always runs in its workspace-write sandbox, and in its read-only sandbox in plan mode.
What always asks
Whatever the setting: