docs: correct denylist behavior under Run until completion

[hongyi-chen]

Problem

auto_approve_bypasses_command_denylist (added in warpdotdev/warp#14489, defaults to true) changed how the command denylist interacts with auto-approve / Run until completion. Two statements on agent-profiles-permissions.mdx predate it and are now inaccurate in opposite directions:

• Command denylist said permission is "always required, regardless of other settings." Not true once Run until completion is on.
• Run until completion said it "ignores the denylist entirely." Overstated — the bypass is configurable, and org-enforced rules are never bypassed.

Actual behavior

Verified against can_autoexecute_command in app/src/ai/blocklist/permissions.rs:

let bypass_user_denylist = auto_approve_enabled
    && !AppExecutionMode::as_ref(ctx).is_sandboxed()
    && *AISettings::as_ref(ctx).auto_approve_bypasses_command_denylist;

• Auto-approve off → full merged denylist (org + user) enforced, takes precedence over Always allow.
• Auto-approve on, setting true (default) → user denylist bypassed; get_org_execute_commands_denylist still enforced.
• Auto-approve on, setting false → full denylist enforced.

Changes

• Reworded the Command denylist precedence sentence and noted Run until completion as the exception.
• Rewrote the Run until completion callout (note → caution, since it's a safety caveat) to state the default bypass, point to the GUI toggle, and clarify that team-enforced rules can't be bypassed.
• Dropped "always" from the "Still getting approval prompts?" caution for consistency.

GUI toggle documented as Settings > Agents > Oz > Input > Allow auto-approve to bypass command denylist (AutoApproveBypassesCommandDenylist in app/src/settings_view/ai_page.rs).

Not changed

The note at line 60 — "When all Agent permissions are set to Always allow ... any denylist rules will still override these settings" — is still correct. Always allow is a profile permission value and does not enable auto-approve, so the denylist genuinely does still apply there. Left as-is.

Validation

npm run build passes (352 pages). style_lint --changed reports 8 findings on this file: 6 screenshot-width and 1 unrecognized-term (line 13) are pre-existing and outside this diff; the line 146 **Input** "unrecognized term" is a menu-path segment, consistent with the existing convention on terminal/input/universal-input.mdx.

Context

Follow-up to #404, which documented this behavior for the Warp Agent CLI and surfaced the inconsistency on this page. That PR targeted the hyc/launch-cli integration branch; this one targets main since it's app behavior and shouldn't be gated behind the CLI launch.

Conversation: https://staging.warp.dev/conversation/dfef0154-c007-40dd-a8f5-0e72b7ea7d34
Run: https://oz.staging.warp.dev/runs/019fb436-e2ee-7290-9f83-d94c6afce961

This PR was generated with Oz.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Jul 31, 2026 4:17am

[hongyi-chen]

Verified the corrected behavior against the client source and it's accurate on all three branches: in can_autoexecute_command (app/src/ai/blocklist/permissions.rs), the user denylist is bypassed only when auto-approve is on and the process isn't sandboxed and auto_approve_bypasses_command_denylist is set, the org denylist from get_org_execute_commands_denylist is always enforced, and with auto-approve off the denylist check precedes (and therefore beats) Always allow. The toggle label and its "Input" section placement match ai_page.rs, and **Settings** > **Agents** > **Oz** > **Input** is the established path used by universal-input.mdx for the same settings widget. Also consistent with the CLI-side documentation of the same behavior from #404 (including the never-bypassed Admin Panel rules). LGTM.

One coordination note: #420 (Phase 0, /agent-platform/ → /agents/) touches this file's path — whichever lands second needs a trivial rebase.

[oz-for-oss]

@hongyi-chen

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

Overview

This docs-only PR updates Agent permissions copy to clarify how Run until completion interacts with the command denylist.

Concerns

• The updated top caution still says Run until completion can bypass "the denylist" without qualifying that only the user's command denylist is bypassed and only when the bypass setting is enabled. That conflicts with the later caution and can keep the page misleading.

Verdict

Found: 0 critical, 1 important, 0 suggestions

Request changes

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

⚠️ [IMPORTANT] This still describes Run until completion as a blanket denylist bypass. When the bypass setting is off, or a team-enforced denylist rule matches, this advice is wrong; qualify it here like the new caution below.

Suggested change

**Still getting approval prompts?** If the Agent keeps asking for permission to run certain commands (like `curl`, `rm`, or `wget`) even though you've set permissions to "Always allow," check your **Command denylist** in **Settings** > **Agents** > **Profiles**. The denylist takes precedence over your other permission settings. Remove commands from the denylist to allow them to auto-execute, or use [Run until completion](#run-until-completion) to bypass the denylist for the current task.

**Still getting approval prompts?** If the Agent keeps asking for permission to run certain commands (like `curl`, `rm`, or `wget`) even though you've set permissions to "Always allow," check your **Command denylist** in **Settings** > **Agents** > **Profiles**. The denylist takes precedence over your other permission settings. Remove commands from the denylist to allow them to auto-execute, or, when **Allow auto-approve to bypass command denylist** is on, use [Run until completion](#run-until-completion) to bypass your command denylist for the current task.