GATE019: Agent auto-approves tool execution

A setting removes the human approval step before the agent runs tools.

Name
Severity
Type
Medium
Description
Default severity. An individual finding may be reported higher or lower when the surrounding configuration justifies it.
Name
Explain locally
Type
gate explain GATE019
Description
The same text, in your terminal, with no network access.

What Gate detected

Gate found a setting that pre-approves tool calls: enableAllProjectMcpServers or a bypassing defaultMode in Claude Code settings, chat.tools.autoApprove in VS Code, autoAccept in Gemini CLI, or a permissive approval_policy / sandbox_mode in Codex. Broad permissions.allow entries that cover execution are included.

Why this matters

Human approval is the control that everything else in agent security quietly assumes. It is what makes a dangerous capability survivable: the agent can propose the destructive action, and a person declines it. Turning approval off does not add a capability, but it removes the last thing standing between a bad decision and its consequences, and it does so for every tool at once, including the ones added later.

Auto-approval is also frequently committed by accident: it is switched on to get through a tedious session and then lands in a shared settings file.

Example

This is the shape of configuration that triggers the rule.

{
  "enableAllProjectMcpServers": true,
  "permissions": {
    "allow": ["Bash(*)"]
  }
}

Remediation

Keep approval on for anything that writes, deletes, spends or executes. Where a workflow genuinely needs unattended operation, scope the auto-approval to specific low-risk tools rather than globally, and keep the setting out of shared, committed configuration.

Suppressing this rule

If this finding is acceptable in your repository, record why alongside the suppression:

gate.config.ts

export default defineConfig({
  ignore: [
    {
      rule: 'GATE019',
      reason: 'Why this is acceptable here',
    },
  ],
})

Gate refuses to apply an ignore entry with no reason. The reason is the only thing that will tell the next person whether the suppression is still true.