Approval policies & sandbox modes
One dropdown next to the composer decides what the agent may do on your machine: Ask, Auto, or Full access. Each mode pairs an approval policy with a sandbox.
Choosing a run mode for the session
The three run modes
Agent Dev asks before acting by default. The run-mode dropdown next to the composer offers three modes — Ask, Auto, and Full access — and you can change it between messages: a careful mode while exploring an unfamiliar repository, a faster one once trust is earned.
| Run mode | What it does | Under the hood |
|---|---|---|
| Ask | The careful default: the agent asks before commands and edits beyond clearly safe reads, and its writes stay inside your workspace. | The on-request approval policy with a workspace-write sandbox. |
| Auto | Codex works freely inside its workspace sandbox without prompting, and anything beyond that sandbox fails rather than interrupting you. Claude Code still asks — it is gated by approvals rather than by a sandbox, so Auto makes no difference to it. | The never approval policy with a workspace-write sandbox. |
| Full access | No prompts and no sandbox: the agent can touch anything your user account can. Policy-gated — not a casual toggle. | The dangerous full-access mode covered in Agent safety. |
Approval policy and sandbox
Behind each mode sit two dials: an approval policy (when the agent must ask) and a sandbox (what it can reach even when approved). For Codex, Ask and Auto both keep writes inside your workspace while the rest of the machine stays off limits, differing only in how often it interrupts you. Claude Code has no sandbox of its own: it is held by the approval prompt instead, so it asks in both modes. Full access removes the guardrails entirely, and that level is policy-gated, not a convenience.
Google Gemini through Antigravity
Build runs Gemini 4 Argon and Gemini 3.8 Flash through the Antigravity CLI whenever Antigravity is installed, and other Gemini models through it when it is the only way to reach them. Other Gemini sessions run through the Gemini CLI or your API key, and this section does not apply to them. In an Antigravity session a turn cannot answer Antigravity's own approval prompts, so whatever Antigravity would ask about is blocked instead, and the chat names what was blocked and how to allow it. Build starts Antigravity without its terminal sandbox.
| Run mode | Through Antigravity |
|---|---|
| Ask | Gemini edits files in your workspace without asking. Commands are blocked, because Antigravity asks before running them. |
| Auto | Antigravity's own Auto mode: file edits and the commands it judges safe go ahead, and anything it would still ask about is blocked. Auto mode is not available on every Google account. Where it is not, Antigravity falls back to its default mode, which blocks commands and file edits alike, and the chat says so the first time it happens. |
| Full access | No approvals: Gemini runs commands and edits files without asking. |
Long-running apps with Antigravity
Antigravity stops the commands still running when a Build turn ends, including an app the agent opened for you, such as a video player or a local server. That command's row then reads Stopped when the turn ended, and a note under the answer says so. Start long-running apps yourself, in a terminal.
Full access is policy-gated
Review is always on
Whatever mode you pick, the record does not switch off: the transcript shows every command and patch, and the files a turn touched are opened for you to read afterwards. Prompts are a dial; review is always on.