OpenCode: OpenCode Permission System
Last updated: 2026-08-31
--- title: OpenCode Permissions and Formatter Tools description: Learn fine-grained permission control and code formatter configuration order: 15 lang: en
Permission configuration is the core of secure OpenCode usage. Formatter tools ensure consistent code style.
1. What You Will Learn
- Three-level permission system
- Fine-grained bash command control
- Agent-level permission overrides
- Formatter tool configuration
2. Three-Level Permission System
| Value | Description | Use Case |
|---|---|---|
allow |
Auto-allow | Safe operations like git status |
ask |
Require confirmation | Risky operations like file editing |
deny |
Auto-reject | Dangerous operations like rm -rf |
3. Global Permission Configuration
JSON
{
"permission": {
"edit": "ask",
"bash": {
"*": "ask",
"git status *": "allow",
"npm test": "allow",
"rm *": "deny",
"sudo *": "deny"
}
}
}
Last matching rule wins. Put * wildcard first, specific rules after.
4. Agent-Level Overrides
JSON
{
"permission": { "edit": "deny" },
"agent": {
"build": { "permission": { "edit": "ask" } },
"review": { "permission": { "edit": "deny" } }
}
}
5. Formatter Tools
Configure in opencode.json:
JSON
{
"formatter": {
"command": "prettier",
"args": ["--write"]
}
}
| Tool | Language | Config |
|---|---|---|
| Prettier | JS/TS/CSS/HTML | "command": "prettier", "args": ["--write"] |
| Black | Python | "command": "black" |
| gofmt | Go | "command": "gofmt", "args": ["-w"] |
| rustfmt | Rust | "command": "rustfmt" |
AI modifies files → formatter runs automatically → consistent code style.
6. Security Best Practices
| Scenario | Recommended Config |
|---|---|
| Daily development | edit: ask, bash: ask, write: ask |
| Code review | edit: deny, write: deny, bash: git read-only |
| CI/CD | edit: allow, bash: allow (restricted) |
| Beginner mode | All permissions set to ask |
❓ FAQ
Q Is ask permission too inconvenient?
A Initially yes, but it's the price of safety. For trusted operations, configure allow to reduce confirmations.
Q Formatter execution fails?
A OpenCode continues the task—formatter failure doesn't block the workflow. Run formatting manually afterward.
📖 Summary
- Three permission levels: allow, ask, deny
- Bash permissions support Glob pattern fine control
- Agent-level permissions override global settings
- Formatter tools ensure consistent code style after AI modifications
- Recommend setting edit and write to ask at minimum
📝 Exercises
-
Basic: Configure global permissions with edit and bash set to ask.
-
Intermediate: Configure bash Glob rules to allow git operations but deny dangerous commands.
-
Advanced: Configure Prettier as formatter and have OpenCode auto-format code after modifications.
