ControlLoopStart free trial

Catch the pull request that hands an agent your whole shell

Coding agents read their permissions from files in your repository. Replace Bash(npm test) with Bash(*), or set a bypass mode, and every developer who opens the project inherits an agent that no longer asks before it acts.

Start free trial Get the CLI on GitHub

Team: 7 days free, then $199 a month per organization. Cancel any time. Compare plans →

Why permission changes slip through review

An allow rule is a standing pre-approval: whatever it matches, the agent runs without asking. In a diff, widening one looks like a cosmetic edit to a JSON array, and reviewers focused on application code rarely stop on it.

Approval modes travel the same way. A project file that sets defaultMode to bypassPermissions in Claude Code, approval_policy to never in Codex, or trust: true on a Gemini CLI server changes how much the agent may do without confirmation, for everyone who clones the repository.

What ControlLoop reports on the pull request
.claude/settings.json
  "permissions": {
-    "allow": ["Bash(npm test)", "Read"]
+    "allow": ["Bash(*)", "Read"],
+    "defaultMode": "bypassPermissions"
  }
policy.widened-permission-ruleHigh

This change lets Claude Code run any shell command without asking: Bash(npm test) became Bash(*).

policy.permission-bypass-from-projectHigh

This change moves Claude Code to bypassPermissions from a project file, so it stops asking for confirmation.

×
ControlLoop gateDeployment blocked
EXIT 1

What ControlLoop reports

Widened rules, not every edit

An added wildcard, or a rule that now covers more than the one it replaced, is reported. A narrowed rule, a new deny or ask rule, or a rule moved between files stays silent.

Shell rules stay high however narrow they look

Bash(npm run:*) runs any script in a package.json the same pull request can edit, so it is reported as high. Read-only tools such as Read and Grep are reported as medium.

Bypass and auto-approve modes

Loosening Claude Code, Codex, or Gemini CLI approval settings from a project file is high severity. Tightening them is silent.

How it works

  1. 01

    Scan the baseline

    Run the CLI or connect the repository. Existing wildcard rules are reported at low severity on the first scan, so you get an inventory instead of a wall of blocks.

  2. 02

    Gate every pull request

    Each change to an allow rule or approval mode is compared with the approved baseline and stated in one plain sentence on the pull request.

  3. 03

    Approve the ones you mean

    A reviewed widening is recorded as an approval in controlloop.yaml, which turns the block into a note with the approver's name.

Questions

Which agents' permission settings does ControlLoop read?

Claude Code, Codex, Gemini CLI, Cursor, Kiro, Cline, and Roo project configuration, plus the CI workflows that run agents. Each host's allow rules and approval modes are compared with your baseline.

Will it block every change to .claude/settings.json?

No. Only changes that give the agent more authority are reported: a widened allow rule or a looser approval mode. Narrowing a rule, adding a deny rule, or moving a rule between files is silent.

What severity blocks the gate?

By default, high and critical findings block. You can change the threshold in controlloop.toml or the GitHub Action's severity-threshold input.

Go deeper

Read the guide: AI agent permissions: least privilege for software that chooses its own actions

More use cases