When an AI agent works on a real project, it needs access to tools — reading files, running commands, writing changes, calling APIs. But not all tools carry the same risk. Reading a log file is different from DROP TABLE. Deleting a file is different from editing a comment.
Orca moved away from treating permissions as a single pile. Every tool gets its own trust level.
Four levels, one tool
Instead of a global “agent can do everything” or “agent must approve everything”, Orca works at the individual tool level. Each tool can be set to one of four levels:
- Allow — the tool runs without asking. Suitable for reading, searching, non-destructive operations.
- Ask — the agent asks before every use. Suitable for writing, deleting, configuration changes.
- Deny — the tool is forbidden for the agent. Suitable for operations that should only be done by a human.
- YOLO — the tool runs without asking and without logging to the timeline. Suitable for fast iterations during development where every approval would break the flow.
YOLO mode is particularly interesting in practice. When you’re debugging a prompt or rapid prototyping, you don’t want to click “approve” every second. YOLO tells the agent: “I trust this tool, do what you need, show me the result when you’re done.”
Permissions visible to the agent
A key detail: the agent knows its permissions. Before every run, Orca provides a summary — which tools are allowed, which are denied, and which require approval. The agent can adapt its approach from the start, instead of hitting closed doors mid-way.
When the agent knows write_file is in Ask mode, it plans its work to minimize approval points — batching changes together. When it knows delete_file is Deny, it figures out an alternative approach right away.
Web UI for management
Permissions are configured in the Account section of the web interface. Each tool has its own card with a level toggle. Rules can be grouped — for example, all file-reading tools set to Allow at once, all destructive tools to Ask or Deny.
For users who prefer the CLI, there’s also a terminal interface for managing permissions.
Strict mode for unattended queries
When an agent runs as part of a scheduled job or automation (e.g., a nightly report), there’s no one to approve. Orca supports a strict mode for unattended queries — if the agent hits a tool in Ask mode, it pauses the operation and waits for human intervention, instead of silently failing or proceeding without authorization.
Why this matters
AI agent safety isn’t about whether to trust the agent or not. It’s about trusting it in specific things, in a specific context. Granular permissions let the agent work fast where it’s safe, and slow down where there’s risk.
YOLO mode proves the point — it’s not about bypassing safety, it’s about deliberately relaxing it in situations where speed matters more than oversight. And strict mode ensures that in automation, the agent never does anything that requires a human decision.
The result is simple: agents have exactly as much freedom as they need, and not a step more.