Last updated: November 1, 2026
Kiro auto approve arrived in Kiro CLI 2.36 on October 29, 2026, as Approve for me. In interactive V3 sessions, Kiro approves routine actions, blocks risky ones and asks when unsure. Your deny, ask and allow rules decide first. Turn it on under /permissions, Policies, and it is saved per workspace.
Contents
- What’s new in Kiro CLI 2.36
- How Approve for me decides
- How to turn on Kiro auto approve
- Subcommand approval rules
- Approve for me versus other presets
- How it compares with Claude Code auto mode
- Other changes in 2.36
- Practical workflows and limitations
- Frequently asked questions
What’s new in Kiro CLI 2.36
Kiro is the coding agent whose website lists Amazon Web Services as its parent organization. The Kiro CLI 2.36 changelog, dated October 29, 2026, headlines three changes: Approve for me, subcommand approval rules and an ACP engine setting.
Before this release, you either answered each permission prompt yourself or trusted every tool for the session. Approve for me adds a middle option.
Each action Kiro approves this way is marked Approved for you on its tool card. The status line shows Approve for me while the mode is on, according to the Kiro CLI V3 permissions guide.
How Approve for me decides
Approve for me works through a rule effect called evaluate. It is the weakest effect in Kiro’s rule chain, which runs in this order: deny, then ask, then allow, then evaluate. Any rule you already have settles an action first. Kiro only judges what is left.
The approve-for-me preset also allows two sets of actions outright, so they never wait for a verdict. Per the Kiro permissions reference, these are workspace reads and writes (the edit-workspace set) and read-only shell commands (the read-only-shell set).
| Situation | What happens |
|---|---|
| A deny or ask rule matches | The rule wins; Approve for me does not override it |
| An allow rule matches | The action runs, as before |
| Workspace read or write, or read-only shell command | Allowed by the preset with no verdict needed |
| No rule settles the action | Kiro approves it, blocks it, or asks you |
| File operation outside the workspace | Not judged; you get the normal prompt |
| Trust classifier unavailable | The preset adds no rules and Kiro keeps asking |
Kiro’s documentation says the mode currently uses Claude Sonnet 4.6 to judge each unsettled action. Built-in protections still apply. For example, Kiro always denies agent writes to its own settings and workspace permission files.
How to turn on Kiro auto approve
You need Kiro CLI 2.36 or later and an interactive local V3 session. Version 3 runs alongside an existing 2.x install, and you start it with the –v3 flag.
- Start a V3 session in your repository with
kiro-cli --v3. - Run
/permissionsand choose Policies. You can jump straight there with/permissions policies. - Choose approve for me. The shortcut is
/permissions policies approve-for-me. - If the page says Approve for me is unavailable in your session, there is nothing to set and Kiro keeps asking.
- Confirm it worked: reopen Policies and check that approve for me is marked
[active]. - To turn it off, choose ask for approval, or run
/permissions policies ask-for-approval.
Kiro stores the choice in the workspace permissions file at ~/.kiro/workspace-roots/<hash>/permissions.yaml as a policies: entry listing approve-for-me. Because the file is per workspace, the setting stays with that repository and does not follow you to others, per the slash commands reference.
Subcommand approval rules
The second 2.36 change affects the Always allow picker. When you approve a command such as git stash pop, the picker now offers a middle tier between the exact command and a broad pattern.
| Tier | Example rule | What it covers |
|---|---|---|
| Exact | git stash pop |
Only that command |
| Subcommand (new) | git stash * |
Any git stash subcommand |
| Pattern | git * |
Any git command |
Kiro does not offer pattern tiers for commands wrapped in sudo or env, or for commands that start with environment variable assignments.
Approve for me versus other presets
Kiro has several named policy presets. All except approve-for-me contain only allow rules. The permissions reference describes them as follows:
| Preset or option | What it does |
|---|---|
read-workspace |
Reads files inside the workspace |
edit-workspace |
Reads and writes files inside the workspace |
dev-shell |
Read-only shell commands plus git writes, common build tools and basic file operations |
approve-for-me |
Workspace edits and read-only shell, plus an evaluate rule for every capability |
allow-all |
Every capability except sandbox network access |
--trust-all-tools or /tools trust-all |
Trusts every tool action your rules do not deny |
Unlike trust-all, Approve for me can still block an action or ask you.
How it compares with Claude Code auto mode
Anthropic’s Claude Code has a similar feature. Its permission modes documentation describes auto mode, in which a separate classifier model reviews actions before they run. With Claude Code v2.1.283 or later, auto mode is the starting mode for interactive terminal and VS Code sessions. For background, see our Claude Code power-user guide.
| Aspect | Kiro Approve for me | Claude Code auto mode |
|---|---|---|
| Default | Off; you opt in per workspace | Starting mode from v2.1.283 |
| Who judges | Classifier, currently Claude Sonnet 4.6 | A separate classifier model |
| Your rules | Deny, ask and allow rules decide first | Explicit ask rules still force a prompt |
| Scope | Saved per workspace | Set per session or in settings |
| Organization control | Administration and enterprise scopes can set deny and ask rules | Admins can turn it off with permissions.disableAutoMode |
Both vendors warn that classifier approval does not replace other safeguards. To compare coding agents more broadly, see our guides to Codex CLI 0.166 and the Cursor Agent SDK.
Other changes in 2.36
- Upgrade warnings:
kiro-cli agent upgradenow warns when V3 rules would block something V2 allowed and shows a warning count per file. - ACP engine setting: a new
acp.agentEnginesetting (v1, v2 or v3) picks the engine forkiro-cli acp. The--agent-engineflag overrides it, and the default is v2. - Safer git variables: in V2 sessions, commands that set git config environment variables such as
GIT_CONFIG_GLOBALnow ask first.
Practical workflows and limitations
- Keep hard limits: add deny rules for commands you never want run, such as
rm -rf *orsudo *. Deny always beats evaluate. - Add the sandbox: Kiro recommends turning on the local command sandbox so an approved command is also limited in what it can reach.
- Review the record: look for
Approved for youon tool cards to see which actions Kiro approved for you.
Limitations: the mode works only in interactive local V3 sessions, not cloud sessions or V2. It does not judge file operations outside the workspace, and it falls back to asking whenever the classifier is unavailable. The pages reviewed for this guide do not tie it to a specific Kiro plan or list a separate charge. For a related tool for teams, see our Copilot Automations guide.
Frequently asked questions
Can Kiro auto approve commands?
Yes. Kiro CLI 2.36, released October 29, 2026, adds Approve for me to interactive V3 sessions. Kiro approves routine actions, blocks risky ones and asks when unsure. Your existing deny, ask and allow rules always decide first.
How do I turn on Approve for me in Kiro CLI?
In an interactive local V3 session, run /permissions, choose Policies, then choose approve for me. You can also run /permissions policies approve-for-me. Kiro saves the approve-for-me preset in that workspace’s permissions file.
Is Approve for me the same as –trust-all-tools?
No. The –trust-all-tools flag and /tools trust-all trust every tool action your rules do not deny. Approve for me sends unsettled actions to a classifier, which can approve, block or ask you.
Which model does Kiro use to judge actions?
Kiro’s documentation says Approve for me currently uses Claude Sonnet 4.6 to judge each action that no rule settles. When the trust classifier is unavailable, the preset adds no rules and Kiro keeps asking.
Does Approve for me work in Kiro cloud sessions?
No. The /permissions command is not available in cloud sessions, and the option appears only in interactive local V3 sessions where Approve for me is available.
How do I turn Kiro auto approve off?
Run /permissions, choose Policies, then choose ask for approval, or run /permissions policies ask-for-approval. If you listed approve-for-me in your user file at ~/.kiro/settings/permissions.yaml, remove it there by hand.
Sources
- Kiro Changelog: CLI 2.36, Approve for Me, Subcommand Approval Rules, and an ACP Engine Setting
- Kiro Docs: Permissions migration (CLI V3), Approve for me
- Kiro Docs: Permissions
- Kiro Docs: Slash commands
- Claude Code Docs: Choose a permission mode
Image: Amazon Web Services logo by Amazon.com, Inc., public domain, via Wikimedia Commons. Placed on a white background and resized. FreeAnswers is not affiliated with Kiro or Amazon Web Services.
Related guide: Devin Desktop 3.11 guide: new Agent Window and Devin Local.
Related guide: Junie Eco Mode guide: Eco, Junie Lite and Junie Local.
4 thoughts on “Kiro Auto Approve: Power-User Guide to Approve for Me in Kiro CLI 2.36”