Allowlist
Also called Allow rules, Permission rules
A list of actions the agent may take without asking. Anything not on it still stops for approval. Rules like Bash(bun test) are how you cut prompts without turning them off.
It is the cheap way to fewer prompts, but a pattern allows more than it looks like. Bash(git *) allows git push --force. Rules also match the text of a command, so a deny rule stops the usual spelling and can miss the same program written another way.
Say it to your agent
“Add to permissions.allow: Bash(bun test), Bash(bun run typecheck), Bash(git diff *), Bash(git status). Do not add Bash(git *) or Bash(bun *), because those also allow git push and bun publish.”