Auto-Approving Read-Only Commands in AI Coding Agents with Hooks
Research subagents fire dozens of read commands per minute. Approving each one manually defeats the purpose of having an agent. But auto-approving everything is reckless. The solution is permission tiers with hooks.
The Problem with Approve-Everything
When an AI agent reads files, searches codebases, or checks git status, these operations are safe. They do not modify anything. But most agent setups treat every command the same - either you approve everything or you approve nothing.
The result is either constant interruptions clicking "approve" on harmless reads, or dangerous auto-approval of commands that could delete files or push to production.
Hook-Based Permission Tiers
A hook intercepts commands before execution and decides whether to auto-approve, prompt for approval, or block entirely. You define rules based on the command type.
Tier one - auto-approve: cat, ls, find, grep, git status, git log, git diff. These are pure reads with no side effects.
Tier two - prompt for approval: git commit, npm install, file writes, API calls. These modify state but are generally safe with review.
Tier three - block or require explicit confirmation: rm -rf, git push --force, sudo commands, anything touching production.
Implementation
The hook checks the command against a whitelist of read-only patterns. If it matches, the command runs immediately without prompting. If it does not match, it falls through to the normal approval flow.
This simple change dramatically improves agent throughput. Research tasks that required fifty manual approvals now run unattended. And you still get prompted before anything dangerous happens.
The Trust Gradient
Start conservative and expand your auto-approve list as you build confidence. Track what gets auto-approved and audit periodically. The goal is maximum automation with minimum risk - not blind trust.
Fazm is an open source macOS AI agent. Open source on GitHub.