{"record":{"id":"99dbedc06b97a5ed","repo":"Hmbown/CodeWhale","slug":"agent-profile-may-not-disable-approval-required","errorCode":null,"errorMessage":"agent profile {} may not disable approval_required","messagePattern":"agent profile (.+?) may not disable approval_required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/fleet/profile.rs","lineNumber":513,"sourceCode":"            ),\n        }\n    }\n\n    if let Some(permissions) = permissions {\n        if permissions.allow_shell.unwrap_or(false) {\n            bail!(\n                \"agent profile {} may not request allow_shell=true\",\n                path.display()\n            );\n        }\n        if permissions.trust.unwrap_or(false) {\n            bail!(\n                \"agent profile {} may not request trust=true\",\n                path.display()\n            );\n        }\n        if permissions.approval_required == Some(false) {\n            bail!(\n                \"agent profile {} may not disable approval_required\",\n                path.display()\n            );\n        }\n    }\n    Ok(())\n}\n\nfn validate_agent_profile_token(path: &Path, field: &str, value: &str) -> Result<()> {\n    let trimmed = value.trim();\n    if trimmed.is_empty() {\n        bail!(\"agent profile {} {field} cannot be empty\", path.display());\n    }\n    if trimmed != value || !trimmed.chars().all(is_agent_profile_token_char) {\n        bail!(\n            \"agent profile {} {field} must be a simple token\",\n            path.display()\n        );","sourceCodeStart":495,"sourceCodeEnd":531,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/fleet/profile.rs#L495-L531","documentation":"Agent profiles may not disable the approval requirement. approval_required is only meaningful when true; setting it to false in an agent profile is treated as permission expansion and rejected at load time.","triggerScenarios":"An agent profile TOML containing `[permissions] approval_required = false` parsed by agent_profile_from_toml; absent or true values pass the guard.","commonSituations":"Copying a permissive workspace permissions block into an agent profile; trying to make an agent run unattended by disabling approvals in its profile instead of at policy level; stale example configs from before the guard existed.","solutions":["Remove the approval_required key or set it to true in the agent profile","Configure unattended/approval-free operation via FleetProfile policy if legitimately needed","Keep the agent profile restrictive and rely on the workspace policy for grants"],"exampleFix":"// before\n[permissions]\napproval_required = false\n\n// after\n[permissions]\napproval_required = true","handlingStrategy":"validation","validationCode":"let approval_off = profile.get(\"permissions\").and_then(|p| p.get(\"approval_required\")) == Some(&toml::Value::Boolean(false));\nif approval_off {\n    eprintln!(\"agent profile may not set approval_required=false\");\n}","typeGuard":null,"tryCatchPattern":"match result {\n    Err(e) if e.to_string().contains(\"approval_required\") => {\n        eprintln!(\"keep approval_required true or remove the key in agent profiles\");\n    }\n    other => other?,\n}","preventionTips":["Never set approval_required=false in an agent profile","Handle unattended operation via workspace policy, not per-agent profile edits"],"tags":["fleet","agent-profiles","permissions","approval"],"backgroundTag":"permission-denied","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}