Approval modes
Control what the Rolit agent may do in your workspace, and review publish, send, and spend actions.
The agent works inside one local workspace, the folder you start rolit in. An approval mode decides which actions run without asking.
Choose a mode
Set the mode with --approval-mode or the ROLIT_APPROVAL_MODE environment variable.
| Mode | Behavior | Default for |
|---|---|---|
auto | Allows ordinary reads, writes, commands, generation, and navigation. Sensitive actions still ask, and hard policy denials still apply. | rolit chat |
cautious | Asks before edits and commands. | rolit run |
edits | Allows workspace edits, still asks for commands. | |
plan-only | Denies writes and commands. |
rolit run --approval-mode plan-only "Review this repository and propose a refactor"There is no unrestricted mode.
Publish, send, and spend always ask
Actions that publish content, send a message, or spend money need an explicit decision in every mode except plan-only, which denies them. Auto never skips these prompts, and subagents can't use send or spend tools.
Pending actions in scripts
Non-interactive sessions and --json runs never approve anything automatically. When a run reaches a publish, send, or spend action, Rolit:
- Records it as a pending action, with arguments redacted.
- Finishes the rest of the work.
- Exits with code
21.
Review pending actions in the same workspace:
rolit approvals list
rolit approvals show <id>
rolit approvals approve <id>
rolit approvals reject <id> --reason "Wrong audience"showdisplays the action and the effect it would have.approveneeds an interactive terminal. It re-checks the record and runs the action at most once.rejectkeeps the record until it expires, for audit.
In an interactive chat, /approvals opens the same list. There, approve <id> shows the verified preview and confirm <id> runs the action. See Slash commands. Tiers for each tool are in Agent tools.
Protected files and secrets
Rolit rejects absolute paths, path traversal, and symlinks that point outside the workspace. Credential files aren't sent to the model as context, and secret-shaped values in file and command output are replaced before upload.