Managing Tool Permissions

Tool permissions provide fine-grained control over how goose uses different tools within extensions. This guide will help you understand and configure these permissions effectively.

Understanding Tools and Extensions

Before diving into permissions, let's clarify the key components:

Extensions are packages that add functionality to goose (like Developer, Google Drive, etc.)
Tools are specific functions within each extension that goose can use

For example, the Developer extension includes multiple tools like:

Text editor tool for file editing
Shell tool for running commands
Screen capture tool for taking screenshots

Performance Optimization

goose performs best with fewer than 25 total tools enabled across all extensions. Consider enabling only the extensions you need for your current task.

Permission Levels

Tool permissions work alongside goose permission modes. The mode sets the default behavior, while tool permissions let you override the behavior of specific tools.

Each tool can be set to one of three permission levels:

Permission Level	Description	Best For	Examples
Always Allow	Tool runs without requiring approval	Safe, read-only operations	• File reading • Directory listing • Information retrieval
Ask Before	Requires confirmation	State-changing operations	• File writing/editing • System commands • Resource creation
Never Allow	Tool cannot be used	Sensitive operations	• Credential access • System-critical files • Resource deletion

Configuring Tool Permissions

goose Desktop

You can configure fine-grained tool permissions for enabled extensions when using Manual or Smart approval mode. These rules can be accessed from the mode toggle or Settings page.

Mode Toggle

Click the button at the bottom of the app
Click the button next to your selected Manual or Smart mode
Click the extension whose tools you want to configure
Use the dropdown next to each tool to set its permission level
Click Save Changes

Settings Page

Click the button in the top-left to open the sidebar
Click the Settings button on the sidebar
Click Chat
Under Mode, click the button next to your selected Manual or Smart mode
Click the extension whose tools you want to configure
Use the dropdown next to each tool to set its permission level
Click Save Changes

goose CLI

Run the configure command:

goose configure

Select goose settings from the menu

┌ goose-configure
│
◆ What would you like to configure?
| ○ Configure Providers
| ○ Add Extension
| ○ Toggle Extensions
| ○ Remove Extension
// highlight-start
| ● goose settings
// highlight-end
└

Choose Tool Permission

┌   goose-configure
│
◇  What would you like to configure?
│  goose settings
│
◆  What setting would you like to configure?
│  ○ goose mode
// highlight-start
│  ● Tool Permission
// highlight-end
|  ○ Tool Output
└

Select an extension and configure permissions for its tools:

┌   goose-configure
│
◇  What setting would you like to configure?
│  Tool Permission 
│
◇  Choose an extension to configure tools
│  developer 
│
◇  Choose a tool to update permission
│  read_image 
│
◆  Set permission level for tool read_image, current permission level: Not Set
│  ○ Always Allow 
 // highlight-start
│  ● Ask Before (Prompt before executing this tool)
// highlight-end
│  ○ Never Allow 
└

Benefits of Permission Management

Review and update your tool permissions as your tasks change. You can modify permissions at any time during a session.

There are several reasons to configure tool permissions:

Performance Optimization
- Keep total enabled tools under 25 for best performance
- Disable tools you don't need for your current task
- Reduce context window usage and improve response quality
- Prevent tool decision paralysis
Security Control
- Restrict access to sensitive operations
- Prevent accidental file modifications
- Control system resource usage
Task Focus
- Enable only tools needed for current task
- Help goose make better tool choices
- Reduce noise in responses

Example Permission Configuration

Task-Based Configuration

Configure permissions based on your current task:

Development Task:
✓ File reading → Always Allow
✓ Code editing → Ask Before
✓ Test running → Always Allow
✗ System commands → Ask Before

Documentation Task:
✓ File reading → Always Allow
✓ Markdown editing → Always Allow
✗ Code editing → Never Allow
✗ System commands → Never Allow