Allow and deny rules

Your patterns

Allow and deny patterns live in ~/.8gent/permissions.json:

{
  "allowedPatterns": ["bun *", "git commit *", "docker compose ps"],
  "deniedPatterns": ["rm -rf /", "sudo rm -rf"],
  "autoApprove": false,
  "logPath": "~/.8gent/logs/permissions.log"
}

• A command matching allowedPatterns runs without a card.
• A command matching deniedPatterns never runs.
• Patterns are globs: * matches anything, ? one character. npm * matches every npm command; bun run dev* matches bun run dev and bun run dev:watch.

Edit the file and restart 8gent. EIGHT_DATA_DIR moves the whole ~/.8gent folder, this file included.

Always ask

These always need your explicit yes, whatever your patterns say:

• Destructive: rm -rf, rm -r, rmdir
• Privilege: sudo, su, doas
• Permissions: chmod, chown, chgrp
• Disks: dd, mkfs, fdisk
• System: systemctl, reboot, shutdown
• Git history: git push --force, git reset --hard
• Remote code: curl ... | sh, wget ... | bash

Run without asking

Common safe commands are approved out of the box:

• package scripts: npm install, bun run, yarn add
• read-only git: git status, git log, git diff
• build, test and lint tools: tsc, vite, jest, vitest, pytest, eslint, prettier, biome
• reading files: ls, cat, head, tail, grep

System One checks every command as well, including ones you allowed: a command its safety rules block stays blocked. Its read-only allowlist only decides which commands it can pass without loading its model; it does not skip your card.

Always blocked

A short list of catastrophic commands, such as rm -rf /, is blocked in every mode, Infinite included.

How the checks stack

For every shell command the agent proposes, in this order:

1. Your deny patterns and the built-in policy. A denied command never runs.
2. A shell-injection check. A command it refuses is blocked before anyone is asked.
3. System One. It can stop a command or put it to you. It never waves a command past your rules.
4. The approval card, for any command not covered by your allow patterns or the built-in safe list. In Guarded, commands System One judges safe skip the card; in Infinite, the card is skipped.

The card's keys: Y runs the command; N, E and S all stop it today.