---
title: Approvals & Guardrails
description: "How to approve or deny what an AI coding agent does on your machine: per-action prompts, session approvals, repository containment, and secret redaction."
---

# Approvals & Guardrails

TheGitAI is built so that nothing happens to your files or shell without your
say-so.

## Approvals

- TheGitAI asks before running shell commands or applying file edits.
- At each prompt: **y** approves once, **a** approves the rest of the session,
  **n** denies.
- `-y` / `--yes` at startup auto-approves every shell command and file edit for
  the whole session — use it with care.

### Password prompts

If an approved `sudo` command needs a password, the terminal UI shows the exact
command and keeps the password **masked and local**. The password is never sent
to the model or the server.

## Guardrails

- **Repo containment** — file and shell operations are confined to the target
  repo root.
- **Ignore rules** — vendor, generated, and sensitive directories (like
  `.git`, `node_modules`, and build output) are excluded from search and
  listing.
- **Command safety** — shell commands require confirmation unless `-y` is used,
  and managed background jobs remain visible and controllable through `/jobs`.
- **Write freshness** — edits are checked against freshly read file content so
  the agent cannot silently overwrite a newer version it did not inspect.
- **Recovery** — assistant edits are journaled, and checkpoint restore refuses
  to overwrite unknown current content.

Long-running commands such as dev servers and watchers run as managed
[background jobs](/docs/core-features/background-jobs). They require the normal
command approval in Default mode and are unavailable in read-only Plan mode.

::tip
Prefer Default mode for unfamiliar work so you can review each command and edit
as it comes up. Reserve `-y` for tasks you've already scoped and trust.
::