Agent permission rules (permission.ask) not enforced at runtime

[rbarcenas-mx]

Description

When an agent is declared in opencode.json with permission rules (e.g., "edit": "ask"), the runtime does not actually enforce them. The model/agent proceeds to execute the tool without asking for confirmation.

Plugins

No response

OpenCode version

1.17.8

Steps to reproduce

1. Configure an agent with restricted permissions:
   "deepseek": {
   "mode": "primary",
   "model": "deepseek/deepseek-chat",
   "permission": {
   "edit": "ask"
   }
   }

2. Select the deepseek agent.

3. Ask it to edit a file - it edits without prompting.Expected behavior: Before performing an edit, bash, grep, etc., the runtime should check the agent's permission block and prompt the user if the value is "ask".

Actual behavior: Permissions are declared but never evaluated. The agent executes tools freely regardless of the permission settings

Screenshot and/or share link

No response

Operating System

Ubuntu 26.04

Terminal

VS Code

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Permissions ignored #16331: Permissions ignored — agent proceeds to read files despite deny/ask rules in the top-level permission config
• opencode not respecting permissions #8832: opencode not respecting permissions — agent ignores bash deny rules at runtime

While your report is specifically about per-agent permission blocks inside an agent definition (rather than the top-level permission config), the underlying enforcement gap may be the same. It would be worth checking whether those issues cover your scenario or if the per-agent permission path is a distinct code path that isn't enforced.

[amadshobi]

Working Workaround: Explicit granular permissions in agent .md frontmatter

If declaring permissions inside opencode.json gets ignored or silently dropped at runtime, you can define them explicitly with granular pattern matching directly inside your agent definition file (.md) frontmatter.

Example (agents/builder.md):

---
description: Custom builder agent with strict permissions
mode: primary
model: <provider/model>
permission:
  bash:
    "*": allow
    "git commit *": ask
    "git push *": ask
    "rm *": deny
    "sed *": ask
  read:
    "*": allow
    "*.env": ask
    ".env*": ask
  edit: ask
---

Why this works:

1. Explicit Granular Patterns: Rather than generic boolean flags, using granular pattern keys ("git commit *": "ask") forces the runtime evaluator to properly match command signatures before execution.
2. Agent-Level Frontmatter Authority: Declaring the permission map directly in the agent's markdown file ensures the agent's execution context loads the permission matrix directly upon agent initialization.