aws / aws/amazon-q-developer-cli

Configurable Permission Levels / "Auto-Allow" for Read-Only Commands in Amazon Q Agent

Open
#3,661 1 comment 4 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
2k
Forks
439
PR merge metrics
No merged PRs in 30d

Description

## Description
Currently, the Amazon Q Agent in VS Code requires explicit user permission for almost every terminal command execution, including read-only operations like grep, find, ls, and cat. While security is a priority, the high frequency of permission popups for non-destructive commands significantly hinders developer velocity and breaks the "autonomous" flow of the agent.

### Proposed Solution
I would like to see a settings configuration or a "Grant Permission" toggle that allows users to:
- Whitlelist Read-Only Commands: Automatically allow commands that do not modify the file system (e.g., grep, find, pwd).
- Trust Session: A "Don't ask again for this session" checkbox on the permission popup.
- Permission Scoping: A setting to allow all commands within a specific workspace directory for a set period.

#### Use Case
When the agent is trying to understand a large codebase, it may run 5–10 grep commands in a row to find definitions. Currently, the user must manually click "Allow" for every single one. This makes the agent feel less like an autonomous assistant and more like a tool that requires constant babysitting.

Image

Additional Context
Extension: Amazon Q / AWS Toolkit for VS Code
Current Behavior: Popup for every command.
Desired Behavior: Seamless execution for safe/read-only commands based on user preference.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.