Skip to main content
Devin Local uses a fine-grained permissions system to control which actions the agent can take.

​
Permission rules

  • Deny rules block actions entirely (highest priority)
  • Ask rules always prompt for approval
  • Allow rules auto-approve actions without prompting
Permissions can be scoped to file reads, file writes, command execution, HTTP fetches, and MCP tools. They can be configured at the project, user, or organization level. In Devin Desktop, configure your own rules in Devin Local settings under Allow, Deny, and Ask. See permissions for the rule syntax. Permission rules written with globs (for example Read(**/*.pem)) match against every workspace directory in the session, including directories added after it started. The mode decides how much the agent asks for actions that no rule covers.

​
Responding to permission requests

When the agent asks for approval, the request card offers a few ways to answer:
  • Edit the command — click the command in the card to change it before approving. The wand action lets you describe the change you want in plain language and has a fast model rewrite the command for you to review.
  • Keyboard shortcuts — approve, always-allow, or reject a request without reaching for the mouse. The shortcut hints are shown on the buttons and dropdown entries.
  • Session-wide grants — an approval you grant for the session applies to every later request in that session, so the root agent and its subagents don’t re-prompt for a scope you already granted.

​
MCP permissions

By default, the Devin Local agent prompts for approval before calling any MCP tool. When the agent wants to invoke an MCP tool, you can allow the specific tool or every tool on that MCP server, either for the current session or permanently.
Enterprise admins can default-allow specific MCP servers or tools so that trusted integrations don’t prompt every time. See tool-based permissions for how to configure these rules.

​
Sandboxing

With sandboxing enabled, the sandbox derives the writable paths from your permission scopes, and Read(...) deny rules hide paths from sandboxed commands.

​
Enterprise controls

Enterprise admins can enforce permission rules, sandbox mode, and network rules for every member. See enterprise controls and the Devin Desktop admin controls.