Whitelist Your AI Agent's Tools for Speed (Without Going Full YOLO)

The Takeaway: Tool allowlists are the sweet spot between full YOLO mode and constant manual approval. By whitelisting safe, routine commands, you let your AI agent work at full speed on the boring stuff while keeping guardrails on anything destructive.

If you've spent any time with AI coding agents, you know the drill. The agent wants to run git diff, then npm test, then read a config file -- and you're hitting 'y' every single time. After about the twentieth approval in a row, you start wondering why you're even there.

The answer isn't to flip on full YOLO mode and let your agent run wild. The answer is tool whitelisting -- selectively pre-approving the commands you trust so the agent only stops to ask when it actually matters.

---

Full YOLO mode (or "dangerously skip permissions" in Claude Code) removes all guardrails. Every command runs without confirmation. That's fine for throwaway experiments, but it's a terrible idea for any project you care about.

I've seen agents confidently run rm -rf on directories they shouldn't touch. I've watched them force-push to main without blinking. YOLO mode trusts the agent completely, and frankly, that trust isn't always earned yet.

---

The concept is simple: you define a list of pre-approved commands and operations, while everything else still requires your confirmation. The agent breezes through safe operations like reading files, running tests, and checking git status -- but it has to stop and ask before doing anything destructive.

Think of it like this: you're not giving the agent the keys to the house. You're giving it the keys to the front door and the kitchen, but the safe stays locked.

---

In Gemini CLI, you traditionally configure allowlists in your ~/.gemini/settings.json file. The tools.allowed array lets you specify exactly which shell commands the agent can run without asking.

Here's a practical starter config for the classic allowlist:

{
  "tools": {
    "allowed": [
      "run_shell_command(npm run lint)",
      "run_shell_command(npm run test)",
      "run_shell_command(git status)",
      "run_shell_command(git diff)",
      "run_shell_command(git log)"
    ]
  }
}

This lets the agent freely run your linter, test suite, and read-only git commands. But if it wants to git push, npm install a new package, or run anything else -- it has to ask you first.

You can also get more specific with infrastructure commands. If you're working with AWS and want the agent to check logs without approval, add those too:

{
  "tools": {
    "allowed": [
      "run_shell_command(aws logs)",
      "run_shell_command(aws cloudwatch)",
      "run_shell_command(aws codebuild)",
      "run_shell_command(git status)",
      "run_shell_command(git diff)"
    ]
  }
}

This pairs beautifully with setting up feedback loops for your agents. When the agent can freely read CloudWatch logs and CodeBuild output, it becomes dramatically better at self-correcting without waiting on you.

---

Claude Code takes a different approach with a more granular permission system. Instead of a single allow list, you get three tiers: allow, deny, and ask. Rules use glob-style patterns and are evaluated in order: deny first, then ask, then allow.

Here's a solid starting configuration for your .claude/settings.json:

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(git diff *)",
      "Bash(git status)",
      "Bash(git log *)",
      "Read(./src/**)",
      "Read(./docs/**)",
      "Edit(./src/**)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(sudo *)",
      "Bash(git push --force *)",
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)"
    ],
    "ask": [
      "Bash(git push *)",
      "Bash(git commit *)",
      "Bash(npm install *)"
    ]
  }
}

This setup is powerful because of the three tiers. The agent can freely read your source code and run tests, but it cannot read your .env files or run destructive commands no matter what. It will also pause to confirm before pushing, committing, or installing new dependencies.

---

Not sure where to start? Here's my recommended approach based on months of daily agent usage.

Safe to whitelist (read-only or low-risk):

• git status, git diff, git log -- read-only git operations
• npm run test, npm run lint, npm run build -- your standard scripts
• File reads on source directories
• Cloud monitoring commands (aws logs, aws cloudwatch)

Keep on ask (moderate risk):

• git commit -- you want to review the message
• git push -- always worth a glance before it goes to remote
• npm install -- new dependencies deserve scrutiny
• File edits outside your source directory

Always deny (high risk):

• rm -rf -- obvious
• sudo anything -- just don't
• git push --force -- protect your history
• Reading .env or secrets files -- keep credentials away from the agent

---

After setting up allowlists on my own projects, the difference was immediate. Tasks that used to involve twenty manual approvals now flow with maybe two or three meaningful pauses, like reviewing a commit message or confirming a push to remote.

The agent spends more time doing and less time waiting. And because I'm only interrupted for decisions that actually matter, I stay in flow instead of becoming a human "yes" button.

---

Here's the quickest path to a faster workflow:

1. Pick your agent: Gemini CLI uses ~/.gemini/settings.json. Claude Code uses .claude/settings.json.
2. Start with read-only: Whitelist git status, git diff, git log, and your test/lint commands.
3. Run for a day: Notice what else the agent keeps asking about. If it's safe, add it to the list.
4. Iterate: Your allowlist should grow organically based on your actual workflow, not a generic template.

The best config is the one you build yourself, tuned to how you actually work.

---

Tool whitelisting is one of those small configuration changes that has an outsized impact on your daily productivity. It takes five minutes to set up and saves you hours of mindless approvals every week.

You don't have to choose between full control and full speed -- allowlists give you both. Start small, iterate based on your workflow, and watch your agent transform from a polite but slow assistant into a fast, focused teammate.