Modes and permissions
Decide how much an agent may do on its own, from planning only to editing and running commands.
Every thread has a mode. It decides what the agent does on its own and what it asks you first. Plan keeps the agent to reading and planning. The other three modes are for acting, and each one asks you less often than the one before.
Choose a mode
The mode menu sits in the composer's bottom row and shows the current mode, such as Accept edits.
- Click the mode menu in the composer.
- Pick a mode. The line under each name says what it does with this thread's agent.
In a thread you can also type /plan or /act to switch between planning and acting.
A change applies from your next message. OpenOrc starts the agent again in the new mode, and it picks up the same conversation. Switching from Review everything or Accept edits to Autonomous also applies to the turn in progress: OpenOrc approves the requests already waiting, except questions and password fields.
New threads start in the mode you picked last. Picking Plan makes Review everything the default instead, though the New thread screen remembers Plan for the project where you chose it. Until you pick a mode, every coding agent starts in Autonomous, which Codex and fx call Full access.
What each mode allows
Each agent enforces the mode with its own rules, so the same choice behaves a little differently, and Codex uses different names. OpenOrc passes these rules to the agent process it starts. Your own configuration files don't change.
| Claude Code | Codex | What runs without asking |
|---|---|---|
| Plan | Plan | Reading and searching. Claude Code can write only its plan, and its shell is off. Codex runs commands in a read-only sandbox, and anything that needs more fails without asking you. |
| Review everything | Review changes | Reading and searching. Claude Code asks before every command and file edit. Codex runs commands in a read-only sandbox and asks before file changes or anything else the sandbox blocks. |
| Accept edits | Ask for approval | File edits inside the thread's folder. Claude Code asks before every command and before edits outside the folder. Codex runs commands inside its sandbox, which has no network access, and asks before anything that needs more. |
| Autonomous | Full access | Everything except typing into a password field in the Preview. Codex also runs without its sandbox. Questions still wait for your answer. |
OpenCode, Cursor, and Antigravity offer Plan and Autonomous. Their saved permission rules can allow actions without a fresh approval, so OpenOrc does not offer Review everything or Accept edits for them. An incompatible saved mode shows Mode unavailable until you choose a supported one.
Oh My Pi and Pi offer all four modes. Review asks before changes and commands; Accept edits permits file edits and asks before commands. Plan blocks tools that change files, while OpenOrc's plan and project tools keep their own permission checks.
fx offers Ask, Auto review, and Full access. Ask follows fx's saved permission rules, Auto review lets fx evaluate actions and ask when needed, and Full access runs outside its sandbox without prompts. fx has no read-only Plan mode. OpenOrc's choice applies to that session and leaves the terminal's default unchanged.
Limits
Outside Autonomous, Claude Code runs with a fixed set of tools: reading, searching, edits, commands, web fetch and search, questions, and skills. Its own subagents and the MCP servers from your Claude Code configuration are off, and OpenOrc's tools stay on. Your MCP servers connect in Autonomous when Your Claude Code MCP servers is on in Settings. In Plan, Codex turns off your own MCP servers too. On Windows, Claude Code can't run in Plan or Accept edits.Plan, then implement
Use Plan to agree on an approach before anything changes. The agent reads the code and writes a plan, which appears in the Plan tab beside the conversation. Reply in the thread to change it. Each revision is kept.
- Open the Plan tab and read the latest revision.
- Choose an Implementation mode. It lists the modes this agent can act in.
- Click Implement this plan. The thread switches to that mode, and the agent starts on the plan.
To keep the plan as a file instead, click Export to project…, name it, and click Create Markdown file. It's saved in the thread's folder.
While planning, the agent can still read your tasks and threads, save tasks to the backlog, and message threads that are also in Plan. It can't start work, save memories, or click and type in the Preview.
Answer an approval
When the agent wants to do something its mode doesn't allow on its own, the turn pauses and an approval card appears under the agent's work. The card names the tool, such as Bash or browser click, gives the reason when there is one, and shows the command or arguments. Raw request shows the full request.
| Answer | What happens |
|---|---|
| Allow | This request runs. |
| Allow for this run | This request runs, and the same kind of request runs without asking until the run ends. |
| Deny | The agent is told no and carries on without it. The transcript keeps a Denied line. |
A run lasts as long as the agent's process, across turns. It ends when OpenOrc closes an idle agent, or when you change the thread's mode or agent.
A waiting request also shows in the thread's row in the sidebar, as Needs approval with the command, and in the Inbox. If you're looking elsewhere, a desktop notification tells you. Stopping the turn or quitting OpenOrc denies every request still waiting.
A question card waits for your answer in every mode, Autonomous included. See Following the work.
OpenOrc's tools
Besides its own tools, every agent gets OpenOrc's: the shared Preview browser, project memory, tasks, the other threads of the project, visualizations, and, with device support on, simulators and emulators. OpenOrc applies the thread's mode to these tools itself, the same way for every agent.
| What the agent does | Plan | Review everything | Accept edits | Autonomous |
|---|---|---|---|---|
Read tasks, threads and project memory. Open, read, scroll or screenshot a page in the Preview. List devices or screenshot one. Draw a visualization in the conversation (visualize). | Runs | Runs | Runs | Runs |
| Save a task to the backlog, or update a task | Runs | Runs | Runs | Runs |
| Start a task in this thread, or start a helper thread | Blocked | Runs | Runs | Runs |
Open or close a simulator or emulator in the Device tab (device open, device close) | Blocked | Runs | Runs | Runs |
Click, type or press keys in the Preview (browser click, browser fill, browser press) | Blocked | Asks | Asks | Runs |
Type into a password field in the Preview (browser fill password) | Blocked | Asks | Asks | Asks |
Save a project memory, or mark one helpful, wrong or stale (memory_record, memory_feedback) | Blocked | Asks | Runs | Runs |
A blocked tool tells the agent why, and nothing happens. The Preview keeps the sessions you signed in to, which is why clicks and typing can ask. A password field gets no text until you allow it, and page snapshots leave out password values.
Messages to other threads follow the receiving thread's mode, since its agent acts on them with its own permissions. A message to a thread in the same or a stricter mode goes through. A message to a more permissive thread asks you first. From Plan, an agent can message only threads that are also in Plan. See Threads working together.
Next steps
Checked against OpenOrc's source on November 9, 2026.