> ## Documentation Index > Fetch the complete documentation index at: https://www.rumus.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Command approval & whitelist > Decide which commands run automatically, which need confirmation, and which are blocked outright. When the agent wants to run a shell command, it's gated by your **command control** rules: a whitelist of base commands that auto-approve, a blacklist of base commands that are blocked outright, and an approval prompt for everything in between. Configure this at **Settings → AI → Conversation → Command Control**. ## How matching works Both the whitelist and blacklist match on the **base command** — the first token of the command line. Patterns are not glob expressions or regex; they're exact matches on that first token. | Command | First token | Matched against | | ------------------------------ | ------------- | -------------------------------------- | | `npm install` | `npm` | the whitelist / blacklist `npm` entry | | `git log --oneline` | `git` | the whitelist / blacklist `git` entry | | `sudo systemctl restart nginx` | `sudo` | the whitelist / blacklist `sudo` entry | | `./deploy.sh` | `./deploy.sh` | exact match only | This keeps the rules predictable. If you whitelist `git`, every `git` invocation runs without asking — `git log`, `git push`, `git rm -rf`, all of them. Choose what to whitelist with that in mind. ## Three statuses Every command the agent wants to run gets one of three statuses: | Status | What happens | Color | | ------------------ | ----------------------------------------- | ----- | | **Auto-approved** | Runs without asking | Green | | **Needs approval** | Pauses and shows the approval prompt | Amber | | **Blocked** | Refuses to run, even if you click approve | Red | Auto-approved means the base command is on your whitelist. Blocked means it's on your blacklist. Anything else falls into "needs approval". ## Defaults Rumus ships with sensible defaults you can edit: **Whitelist (auto-approved):** `npm`, `pnpm`, `yarn`, `cargo`, `node`, `git`, `bun` — common dev-tool entry points that are read-mostly in normal use. **Blacklist (blocked):** `rm`, `del`, `mv`, `copy`, and similar destructive primitives — the things you don't want a fast-moving agent to invoke. You can add to or remove from either list freely. ## The approval prompt When a command needs approval, you see three buttons: * **Run** — runs this one command. The next time the agent wants to run something with the same base command, you'll be asked again. * **Always Allow** — runs this command **and** adds the base command to your whitelist. Future invocations with the same first token auto-approve. * **Cancel** — refuses; the agent gets a "denied" signal and decides what to do next (try a different approach, or report back to you). You can also **edit the command before approving**. If the agent proposes `kubectl delete pod foo` and you actually want `kubectl describe pod foo`, edit the text in place, then click Run. ## The blocked prompt Blacklisted commands show a **Blocked** badge and don't expose a Run button — the only path forward is to **edit the command into something not blacklisted** and then approve the edited version. Example: the agent proposes `rm /tmp/cache.bin` (blocked because `rm` is blacklisted by default). Edit to `find /tmp/cache.bin -delete`, and that goes through the normal approval flow. ## Tips for setting up the lists * **Whitelist tools you trust at the binary level.** `git`, `make`, `kubectl get` — wait, you can't whitelist a sub-command. So whitelist `git` knowing it includes `git push --force` too. * **Blacklist anything that scares you.** Adding `dd` and `mkfs` is cheap insurance even if the agent rarely tries them. * **Default approval is the safe middle.** When in doubt, leave a command out of both lists — the prompt is just one click and you'll quickly learn which patterns you genuinely want to auto-approve. * **Look at how long it takes you to click Always Allow on common commands.** Patterns you approve every day belong on the whitelist; patterns you approve once a month don't. ## What if the prompt is happening too often? If you're approving the same command over and over, click **Always Allow** once and stop being asked. If approvals are coming up for *commands you didn't expect to be gated*, check the conversation: it's possible the agent is calling a tool with a wrapper script (e.g. `bash -c "git status"`), and `bash` is the base command that's being matched, not `git`. Adjust the agent's instructions, or add `bash` to the whitelist if you trust it. ## Where settings live * **Whitelist / Blacklist** — Settings → AI → Conversation → Command Control. Edit each list as plain text, one entry per line. * **Auto-approve safe tools** — a separate toggle that lets read-only tools (read file, web fetch) run without prompts. On by default. * **Reset to defaults** — wipes your whitelist and blacklist and restores the shipping defaults. ## Sub-agents and approvals When a [sub-agent](/docs/ai/sub-agents) wants to run something that needs approval, the prompt **bubbles up to the parent conversation**. You answer once and the sub-agent gets the answer. This means heavily-parallel runs can pile up several pending approvals at once if the whitelist isn't tuned. If that's annoying, whitelist the relevant base commands. ## Next steps The full picture of how the agent decides what to run. Constrain the agent's behavior at the prompt level, not just the command level.