Agent Profiles & Permissions

Agent Profiles

Agent Profiles let you configure how your Agent behaves in different situations. Each profile defines the Agent's autonomy, base and planning models, and tool access. You can create multiple profiles and edit them directly in Settings > AI > Agents > Profiles.

• Default profile: Every user starts with a default profile, you can edit it at any time, and new profiles will copy its settings as a starting point.

• Other profiles: Set up different profiles for different workflows (e.g., "Safe & cautious", "YOLO mode", etc.). Manage them in the Profiles settings menu.

In each Agent Profile, you can configure:

• The name of the profile

• Base and planning models

  • Base model: The core engine for your Agent. It handles most interactions and invokes other models when needed (e.g. for planning or code generation).

  • Planning model: Responsible for breaking down complex tasks into actionable steps. It generates structured execution plans and decides how to route work between models.

• Agent Permissions

Agent Permissions

Agent Permissions let you define how your Agent in a specific Profile operates — control its autonomy, choose what tools or MCP servers it can access, and set when it should act independently or ask for approval.

You can control how much autonomy the Agent has when performing different types of actions under Settings > AI > Agents > Profiles > Permissions . Agent permission types:

• Apply code diffs

• Read files

• Create plans

• Execute commands

Each permission has different levels of autonomy:

Command allowlist

The Warp Agent lets you define an allowlist of commands that run automatically without confirmation. It’s empty by default, but users often add read-only commands such as:

• which .* - Find executable locations

• ls(\s.*)? - List directory contents

• grep(\s.*)? - Search file contents

• find .* - Search for files

• echo(\s.*)? - Print text output

You can add your own regular expressions to this list in Settings > AI > Agents > Command allowlist. Commands in the allowlist will always auto-execute, even if they are not read-only operations.

Command denylist

For safety, the Agent always prompts for confirmation before executing potentially risky commands. The default denylist includes several examples, such as:

• wget(\s.*)? - Network downloads

• curl(\s.*)? - Network requests

• rm(\s.*)? - File deletion

• eval(\s.*)? - Shell code execution

The denylist takes precedence over both the allowlist and Agent decides. If a command matches the denylist, user permission will always be required, regardless of other settings. You can add your own regular expressions to this list in Settings > AI > Agents > Command denylist.

MCP permissions

MCP servers let you extend the Agent with custom tools and data sources using standardized, plugin-like modules.

In this settings menu, you can configure which MCP servers the Agent is allowed to call:

• Use the MCP allowlist to give the Agent permission to call specific servers without asking.

• Use the MCP denylist to require approval before calling certain servers, even if they’re also in the allowlist.

• Or set the Agent to “decide” — it will act autonomously when confident, and ask for confirmation when uncertain.

Run until completion

During an Agent interaction, you can give the Agent full autonomy for the current task. When auto-approve is on, every suggested command runs immediately until the task finishes, or you stop it with Ctrl + C.