Otto permissions

LabsThis feature is in Labs.

Otto ships a first-party permission layer that gates every tool call. Each call resolves to allow, ask (prompt the user), or deny based on the active permission mode and your configured rules. Out of the box, Otto asks before running destructive Astro and Airflow commands, prompts before writing to sensitive files like .env or .ssh/*, and restricts writes outside your project folder. You can extend or relax these behaviors through config files and permission modes.

Permission modes

Otto runs in one of five modes. Cycle through modes interactively with Ctrl+] or the /permissions command.

Mode	Behavior
`default`	Normal behavior. Tools are allowed, denied, or prompted based on your rules.
`acceptEdits`	Auto-allows `edit` and `write` inside the project. Other tools fall through to the normal rules. Safety checks still fire.
`confirmEdits`	Prompts before `edit`, `write`, and non-read-only `bash`. Allow rules can’t bypass the prompt. Read tools and read-only `bash` fall through to the normal rules.
`plan`	Blocks `edit` and `write` entirely. Restricts `bash` to a read-only allowlist (`ls`, `cat`, `git`, `rg`, `af`, `astro`, etc.).
`bypassPermissions`	Allows everything except bypass-immune safety checks on sensitive files and out-of-project writes.

Set the starting mode with the --permission-mode <mode> flag or the OTTO_PERMISSION_MODE environment variable.

Where configuration lives

Otto reads permissions from three files, merged in order (later wins):

Scope	Path	Purpose
User	`~/.astro/otto/permissions.json`	Your personal rules across all projects
Project	`.astro/otto/permissions.json`	Team-wide rules committed to Git
Local	`.astro/otto/permissions.local.json`	Your local-only overrides (gitignore this file)

Commit project-scope rules to your repository so every engineer on the team gets the same posture.

Configuration file shape

{
  "enabled": true,
  "defaultMode": "default",
  "restrictToProjectDir": true,
  "rules": {
    "allow": ["Bash(ls:*)"],
    "deny": ["Bash(rm -rf /:*)"],
    "ask": ["Bash(git push:*)"]
  },
  "pathDeny": [
    {
      "id": "no-root-writes",
      "patterns": ["/etc/**", "/usr/**"],
      "tools": ["write", "edit", "bash"],
      "message": "Refusing to write outside user-space."
    }
  ],
  "commandPatterns": [
    {
      "id": "my-dangerous",
      "pattern": "\\bdrop\\s+database\\b",
      "regex": true,
      "behavior": "ask",
      "description": "drop database"
    }
  ],
  "contentPatterns": [
    {
      "id": "no-eval-in-dags",
      "pattern": "eval\\(",
      "regex": true,
      "onTool": ["write", "edit"],
      "pathGlobs": ["**/dags/**/*.py"],
      "behavior": "deny",
      "message": "Avoid eval() inside Dag code."
    }
  ]
}

Rule strings

Rules use the format Tool or Tool(content). Content can be a command prefix, a path glob, or * to match everything.

Rule	Effect
`Bash`	Matches every `bash` call
`Bash(astro deploy:*)`	Matches bash commands starting with `astro deploy`
`Write(/etc/**)`	Matches `write` calls whose path glob-matches `/etc/**`
`Read(~/.ssh/**)`	Matches `read` calls with `~` expansion

Path deny

pathDeny blocks writes and edits against a glob list, including bash redirects. Use it to protect folders regardless of the command used to reach them.

Command patterns

Bash-only patterns that match the full command string. Use regex: true for regular expressions. commandPatterns with behavior: "ask" fire even in bypassPermissions mode.

Content patterns

Scan the body of write and edit calls against a pattern. behavior: "deny" blocks the write before it hits disk. behavior: "warn" appends an advisory without blocking.

Built-in safety checks

Otto ships compiled-in protections that fire regardless of configuration:

Sensitive files — prompts before any tool touches .env*, ~/.ssh/**, ~/.aws/**, shell rc files, or similar common secret locations.
Destructive Astro and Airflow commands — prompts before astro deploy, astro deployment delete, astro workspace delete, astro organization delete, astro dev kill, af dags delete, af runs delete, af tasks clear, af connections delete, af variables delete, and similar destructive commands.
Out-of-project writes — prompts before write, edit, or a bash command targets a path outside your project folder.

These checks are bypass-immune — they fire even when the mode is bypassPermissions or --skip-permissions is set. Disable an individual destructive-command entry in your config by id:

{
  "commandPatterns": [
    { "id": "astro-deploy", "enabled": false }
  ]
}

Inspect the current state

Run /permissions in an Otto session to see the current mode, rule counts, and the file paths for each config scope.

Disable permissions for a session

astro otto --skip-permissions

This coerces the mode to bypassPermissions and prevents Ctrl+] from cycling out of it for the session. Bypass-immune safety checks still fire. Use it only for scripted flows you’re reviewing by hand.

Overview

Get started

Develop DAGs

AI features

Deploy code

Manage Deployments

Automation & CI/CD

Platform observability

Administration

Release notes

Best practices

Reference

Airflow 3

Permission modes

Where configuration lives

Configuration file shape

Rule strings

Path deny

Command patterns

Content patterns

Built-in safety checks

Inspect the current state

Disable permissions for a session

​Permission modes

​Where configuration lives

​Configuration file shape

​Rule strings

​Path deny

​Command patterns

​Content patterns

​Built-in safety checks

​Inspect the current state

​Disable permissions for a session

Permission modes

Where configuration lives

Configuration file shape

Rule strings

Path deny

Command patterns

Content patterns

Built-in safety checks

Inspect the current state

Disable permissions for a session