# Set trust mode

Trust mode controls whether the main agent **gates risky tool calls** behind a human approval, or runs them automatically.

| Mode | Behavior |
|------|----------|
| `approval_required` | **Safe default.** Risky calls create an approval request you must approve. |
| `auto` | Skips the gate for risk tier **high and below**. |

## The risk tiers (always enforced)

Trust mode never overrides these:

- `blocked` → refused outright.
- `irreversible_external` → **always** creates an approval request, even in `auto`. This is the load-bearing guarantee that an agent on auto-trust cannot make irreversible external writes without a human in the loop.
- `high` / `medium` → gated in `approval_required`, allowed in `auto`.
- `low` → always executes.

## Set it

Press **⌘K**, type `trust`, choose **Set main-agent trust mode**, pick a mode, Save. Flipping to `auto` is itself an audited event.

## Verify

The current mode shows in **Settings → Advanced**, and trust-mode flips appear in the **Audit** log.

## Related

- [Create an agent](/help/create-agent)
