aws / aws/amazon-q-developer-cli
Configurable Permission Levels / "Auto-Allow" for Read-Only Commands in Amazon Q Agent
- Dominant language
- Rust
- Stars
- 2k
- Forks
- 439
- PR merge metrics
- No merged PRs in 30d
Description
## Description
Currently, the Amazon Q Agent in VS Code requires explicit user permission for almost every terminal command execution, including read-only operations like grep, find, ls, and cat. While security is a priority, the high frequency of permission popups for non-destructive commands significantly hinders developer velocity and breaks the "autonomous" flow of the agent.
### Proposed Solution
I would like to see a settings configuration or a "Grant Permission" toggle that allows users to:
- Whitlelist Read-Only Commands: Automatically allow commands that do not modify the file system (e.g., grep, find, pwd).
- Trust Session: A "Don't ask again for this session" checkbox on the permission popup.
- Permission Scoping: A setting to allow all commands within a specific workspace directory for a set period.
#### Use Case
When the agent is trying to understand a large codebase, it may run 5–10 grep commands in a row to find definitions. Currently, the user must manually click "Allow" for every single one. This makes the agent feel less like an autonomous assistant and more like a tool that requires constant babysitting.
Additional Context
Extension: Amazon Q / AWS Toolkit for VS Code
Current Behavior: Popup for every command.
Desired Behavior: Seamless execution for safe/read-only commands based on user preference.
Contributor guide
Assessment
This issue has not been assessed yet.