Tool permissions

Symbiotic Code supports a layered permission configuration that controls whether the AI can run bash commands, write files, or edit files without prompting you every time

Load order

Configs are deep-merged. Later sources win.

#	Source	Notes
1	Project and global config files	`symbiotic.json`/`symbiotic.jsonc`, plus `.symbiotic` directories discovered for the project
2	`SYMBIOTIC_CONFIG` env var	Custom config file path
3	`SYMBIOTIC_CONFIG_CONTENT` env var	Inline JSON/JSONC config content
4	Managed config	System administrator-controlled config, loaded at highest config priority
5	`SYMBIOTIC_PERMISSION` env var	Inline JSON permission overrides, parsed as JSON

Config schema

{
  "permission": {
    "bash":  <rule>,
    "edit":  <rule>,
    "read":  <rule>,
    "external_directory": <rule>
  }
}

A <rule> is either:

A string: "allow", "ask", or "deny" -> applies to all inputs
A pattern map: { "<pattern>": "<rule>", ... } -> evaluated in merged rule order; the last matching rule wins

Pattern matching

Wildcard	Matches	Used in
`*`	anything (including spaces for commands, excluding `/` for paths)	both
`**`	anything including `/`	paths only

Rules are evaluated by pattern match, with the last matching rule winning. Put broad rules first and more specific overrides after them.

Examples

1. Deny all bash, ask for writes, auto-allow `src/`

.symbiotic/symbiotic.json:

{
  "permission": {
    "bash": "deny",
    "write": {
      "*": "ask",
      "src/**": "allow",
      "*.env": "deny"
    },
    "edit": "ask"
  }
}

What happens:

Action	Result
`bash: "ls -la"`	Denied immediately, no prompt
`write: "src/core/tools/bash.ts"`	Auto-allowed (matches `src/**`)
`write: ".env"`	Denied immediately (matches `*.env`)
`write: "README.md"`	Prompts you (matches `*`)
`edit: "any file"`	Prompts you

2. Allow safe git commands, deny destructive ones

{
  "permission": {
    "bash": {
      "*": "ask",
      "git *": "allow",
      "git commit *": "deny",
      "git push *": "deny",
      "grep *": "allow",
      "ls *": "allow"
    }
  }
}

What happens:

Command	Matched pattern	Result
`git status`	`git *`	Auto-allowed
`git log --oneline`	`git *`	Auto-allowed
`git commit -m "foo"`	`git commit *`	Denied
`git push origin main`	`git push *`	Denied
`grep -r "TODO" src/`	`grep *`	Auto-allowed
`npm install`	`*`	Prompts you

Pattern specificity: git commit * (11 literal chars) beats git * (4 literal chars) beats * (0 literal chars).

3. Trust the whole project — allow everything

{
  "permission": {
    "bash": "allow",
    "write": "allow",
    "edit": "allow"
  }
}

No prompts at all. Useful for trusted personal projects.

4. Lock down everything — full review mode

{
  "permission": {
    "bash": "ask",
    "write": "ask",
    "edit": "ask"
  }
}

Every action requires your approval. This is the default behavior when no config is present.

Deep merge behavior

When multiple sources define rules for the same tool, pattern maps are merged (later keys win), and string rules replace entirely. Example: symbiotic.json defines bash rules, .symbiotic/symbiotic.json adds more specific ones: symbiotic.json:

{ "permission": { "bash": { "*": "ask", "ls *": "allow" } } }

.symbiotic/symbiotic.json:

{ "permission": { "bash": { "git push *": "deny" } } }

Effective config:

{ "permission": { "bash": { "*": "ask", "ls *": "allow", "git push *": "deny" } } }

“Allow always” persistence

When you choose Allow always at a permission prompt, the approval is saved to the global Symbiotic configuration and takes effect immediately — no restart needed.

How patterns are stored

For bash commands, the stored pattern depends on the command structure:

Command	Stored pattern	Rationale
`git commit -m "feat: add x"`	`"git commit *"`	Multi-level CLI: binary + subcommand wildcard
`bun run dev`	`"bun run *"`	Multi-level CLI
`docker build -t app .`	`"docker build *"`	Multi-level CLI
`ls -la`	`"ls -la"`	Exact — single-purpose command
`rm -rf dist/`	`"rm -rf dist/"`	Exact — too dangerous to generalize
`curl <https://api.example.com`>	`"curl <https://api.example.com>"`	Exact

For write/edit, the exact file path is stored.

Shell operator security

Shell-operator handling is enforced by the Bash tool layer. Do not rely on a permission pattern alone to make compound commands safe; review commands containing &&, ||, ;, or | carefully.

Live config reload

The config is re-read from disk on every tool call. You can edit any config file (symbiotic.json, .symbiotic/symbiotic.json, or the file pointed to by SYMBIOTIC_CONFIG) while Symbiotic is running and changes take effect on the next tool execution — no restart required.

File Locations

your-project/
├── symbiotic.json              # project-level config (committed)
├── .symbiotic/
│   └── symbiotic.json          # local overrides + persisted approvals (gitignore this)
└── SYMBIOTIC_PERMISSION.json   # pointed to via SYMBIOTIC_PERMISSION env var

Recommendations

Commit symbiotic.json with team-wide defaults
Use .symbiotic/symbiotic.json for personal overrides
Add .symbiotic/ to .gitignore

Basics

Tools

Configuration

Load order

Config schema

Pattern matching

Examples

1. Deny all bash, ask for writes, auto-allow `src/`

2. Allow safe git commands, deny destructive ones

3. Trust the whole project — allow everything

4. Lock down everything — full review mode

Deep merge behavior

“Allow always” persistence

How patterns are stored

Shell operator security

Live config reload

File Locations

​Load order

​Config schema

​Pattern matching

​Examples

​1. Deny all bash, ask for writes, auto-allow src/

​2. Allow safe git commands, deny destructive ones

​3. Trust the whole project — allow everything

​4. Lock down everything — full review mode

​Deep merge behavior

​“Allow always” persistence

​How patterns are stored

​Shell operator security

​Live config reload

​File Locations

Load order

Config schema

Pattern matching

Examples

1. Deny all bash, ask for writes, auto-allow `src/`

2. Allow safe git commands, deny destructive ones

3. Trust the whole project — allow everything

4. Lock down everything — full review mode

Deep merge behavior

“Allow always” persistence

How patterns are stored

Shell operator security

Live config reload

File Locations