Instead of only allowing you to configure which Bash commands are allowed to run and which aren't, Amp now gives you the ability to define which tool it's allowed to run, and with which arguments.
\nWhen Amp wants to call a tool, it first checks your list of permissions to find an entry that matches the tool and the tool call arguments. The matched entry then tells Amp to either allow the tool call, reject it, ask you for confirmation, or delegate the decision to another program. If no matching entry is found, Amp checks the built-in permission list that contains sensible defaults.
\nYou can define these granular tool-level permissions by adding entries to the amp.permissions list in your configuration file. Here's an example:
"amp.permissions": \nYou can read more about the new tool-level permissions in the manual.
\n", "content_markdown": "Instead of only allowing you to configure which Bash commands are allowed to run and which aren't, Amp now gives you the ability to define which tool it's allowed to run, and with which arguments.\n\nWhen Amp wants to call a tool, it first checks your list of permissions to find an entry that matches the tool and the tool call arguments. The matched entry then tells Amp to either *allow* the tool call, *reject* it, *ask* you for confirmation, or *delegate* the decision to another program. If no matching entry is found, Amp checks the built-in permission list that contains sensible defaults.\n\nYou can define these granular tool-level permissions by adding entries to the `amp.permissions` list in your [configuration file](https://ampcode.com/manual#permissions). Here's an example:\n\n```json\n\"amp.permissions\": [\n // Ask before running a command containing \"git commit\"\n { \"tool\": \"Bash\", \"matches\": { \"cmd\": \"*git commit*\" }, \"action\": \"ask\"},\n // Reject command containing \"python \" or \"python3 \"\n { \"tool\": \"Bash\", \"matches\": { \"cmd\": [\"*python *\", \"*python3 *\"] }, \"action\": \"reject\"},\n // Ask before running any MCP tool\n { \"tool\": \"mcp__*\", \"action\": \"ask\"},\n // Delegate everything else to a permission helper (must be on $PATH)\n { \"tool\": \"*\", \"action\": \"delegate\", \"to\": \"my-permission-helper\"}\n]\n```\n\nYou can read more about the new tool-level permissions [in the manual](https://ampcode.com/manual#permissions).\n", "dateCreated": "2026-10-04T12:50:30.804479567+00:00", "date_created": "2025-08-07T00:00:00+00:00", "date_modified": "2025-08-07T00:00:00+00:00", "date_published": "2025-08-07T00:00:00+00:00", "description": "Instead of only allowing you to configure which Bash commands are allowed to run and which aren't, Amp now gives you the ability to define which tool it's allowed to run, and with which arguments. When Amp wants to call a tool, it first…", "external_url": "https://ampcode.com/news/tool-level-permissions", "git": { "commit": "ebb0941c5c06a2ab2377342d607535262a3e969e", "path": "items/ampcode-com/2025/08/2025-08-07-tool-level-permissions.md", "permalink": "https://github.com/aymericbeaumet/aggr-instance/blob/ebb0941c5c06a2ab2377342d607535262a3e969e/items/ampcode-com/2025/08/2025-08-07-tool-level-permissions.md" }, "id": "urn:aggr:item:6d7e03751b5477ca66c36aa74e5f40470c8bfa3d", "isBasedOn": { "@id": "https://ampcode.com/news/tool-level-permissions" }, "mainEntity": { "@id": "https://ampcode.com/news/tool-level-permissions", "@type": "CreativeWork", "archivedAt": { "@id": "https://aggr.aymericbeaumet.com/items/ampcode-com/2025-08-07-tool-level-permissions/#webpage" }, "dateModified": "2025-08-07T00:00:00+00:00", "datePublished": "2025-08-07T00:00:00+00:00", "headline": "Tool-Level Permissions", "timeRequired": "PT1M", "url": "https://ampcode.com/news/tool-level-permissions", "wordCount": 198 }, "name": "Archived snapshot: Tool-Level Permissions", "preview": null, "reading_minutes": 1, "replicated_at": null, "source": "ampcode-com", "source_name": "Amp News", "summary": "Instead of only allowing you to configure which Bash commands are allowed to run and which aren't, Amp now gives you the ability to define which tool it's allowed to run, and with which arguments. When Amp wants to call a tool, it first checks your list of permissions to find an entry that matches the tool and the tool call arguments. The matched entry then tells Amp to either allow the tool call, reject it, ask you for confirmation, or delegate the decision to another program. If no matching entry is found, Amp checks the built-in permission list that contains sensible defaults. You can define these granular tool-level permissions by adding entries to the amp.permissions list in your configuration file. Here's an example: \"amp.permissions\": [ // Ask before running a command containing \"git commit\" { \"tool\": \"Bash\", \"matches\": { \"cmd\": \"*git commit*\" }, \"action\": \"ask\"}, // Reject command containing \"python \" or \"python3 \" { \"tool\": \"Bash\", \"matches\": { \"cmd\": [\"*python *\", \"*python3 *\"] }, \"action\": \"reject\"}, // Ask before running any MCP tool { \"tool\": \"mcp__*\", \"action\": \"ask\"}, // Delegate everything else to a permission helper (must be on $PATH) { \"tool\": \"*\", \"action\": \"delegate\", \"to\": \"my-permission-helper\"} ] You can read more about the new tool-level permissions in the manual.", "tags": [], "temporalCoverage": "2026-10-04T12:50:30.804479567+00:00", "title": "Tool-Level Permissions", "url": "https://aggr.aymericbeaumet.com/items/ampcode-com/2025-08-07-tool-level-permissions/", "word_count": 198 }