# Permissions.json allowlists disable Auto-review (with Sandbox) — contradicts docs **URL:** \ **Category:** Bug Reports\ **Tags:** sandbox, auto-run\ **Created:** [July 14, 2026, 3:31pm UTC](https://forum.cursor.com/t/permissions-json-allowlists-disable-auto-review-with-sandbox-contradicts-docs/165722 "2026-07-14T15:31:33Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![haagendazs](https://avatars.discourse-cdn.com/v4/letter/h/7bcc69/32.png) [@haagendazs](https://forum.cursor.com/u/haagendazs)\ **Post date:** [July 14, 2026, 3:31pm UTC](https://forum.cursor.com/t/permissions-json-allowlists-disable-auto-review-with-sandbox-contradicts-docs/165722/1 "2026-07-14T15:31:33Z")
### Where does the bug appear (feature/product)? Cursor IDE ### Describe the Bug ### Environment - **Cursor:** 3.11.19 (macOS arm64) - **Run Mode UI:** Settings → Agents → Approvals & Execution - **Config:** `~/.cursor/permissions.json` + `~/.cursor/sandbox.json` ### Summary When `~/.cursor/permissions.json` defines a non-empty `terminalAllowlist` and/or `mcpAllowlist`, **Auto-review (with Sandbox) becomes non-selectable**. Only **Allowlist** and **Allowlist (with Sandbox)** remain usable. **Run Everything** is correctly disabled (banner mentions this), but Auto-review is also locked out — which the banner does **not** mention. This contradicts the public docs, which describe Auto-review as **allowlist → sandbox → classifier** and show `terminalAllowlist` + `autoRun` used together ([permissions.json reference](https://cursor.com/docs/reference/permissions), [Run Modes](https://cursor.com/docs/agent/security/run-modes)). ### Expected I should be able to select **Auto-review (with Sandbox)** so that: 1. allowlisted commands run immediately, 2. other eligible shell commands run in the sandbox, 3. the rest go to the classifier (steered by `autoRun`). ### Actual `autoRun` in the same file has no effect because Auto-review cannot be selected. ### Notes / UX issues - The banner only warns about Run Everything; it does not say Auto-review is also unavailable. - Auto-review still appears in the list, which suggests it should be choosable. - Hover/tooltip can imply admin disablement even when the only cause is a local `permissions.json` (no team admin policy). ### What we tried Setting undocumented `"approvalMode": "unrestricted"` (parsed by the client but not in the public field table) **broke the Run Mode control entirely** (no options shown). Removing that key restored Allowlist / Allowlist (with Sandbox), with Auto-review still locked. Do not recommend this as a workaround. ### Why this matters Projects that want a **checked-in / copy-pasteable allowlist** (stable command surface) cannot use the documented Auto-review composition. They are forced into pure Allowlist modes, so `autoRun` classifier steering is dead while the file owns the allowlist. ### Ask Please either: 1. **Fix:** allow Auto-review when `permissions.json` defines allowlists (allowlist as tier 1, as docs describe), and update the banner to match; or 2. **Document:** if this lock is intentional, state clearly that a non-empty file allowlist forces Allowlist-only modes and that `autoRun` only applies when allowlists are IDE-managed (not in the file). ### Steps to Reproduce 1. Create `~/.cursor/permissions.json` with a non-empty `terminalAllowlist` (and/or `mcpAllowlist`). 2. Open Settings → Agents → Approvals & Execution. 3. Banner appears: allowlists are set by the file; **Run Everything is disabled** while the file defines allowlists. 4. Open the Run Mode dropdown: - **Allowlist** — selectable - **Allowlist (with Sandbox)** — selectable - **Auto-review (with Sandbox)** — visible but **not selectable** - **Run Everything (Unsandboxed)** — disabled (as documented by the banner) `autoRun` in the same file has no effect because Auto-review cannot be selected. ### Expected Behavior With a file like: ```json { "terminalAllowlist": ["git", "ls"], "autoRun": { "allow_instructions": ["Read-only git commands are fine."], "block_instructions": ["Never auto-approve rm -rf."] } } ``` I should be able to select **Auto-review (with Sandbox)** so that: 1. allowlisted commands run immediately, 2. other eligible shell commands run in the sandbox, 3. the rest go to the classifier (steered by `autoRun`). ### Screenshots / Screen Recordings ![Screenshot 2026-07-14 at 11.30.27.png](https://us1.discourse-cdn.com/cursor1/original/3X/9/2/9296591dfa1244a0b77a61779956d071908d9fcd.jpeg) ### Operating System MacOS ### Version Information Version: 3.11.19 VS Code Extension API: 1.125.0 Commit: bf249e6efb5b097f23d7e21d7283429f0760b740 Date: 2026-07-12T21:39:24.175Z Layout: IDE Build Type: Stable Release Track: Default Electron: 40.10.3 Chromium: 144.0.7559.236 Node.js: 24.15.0 V8: 14.4.258.32-electron.0 xterm.js: 6.1.0-beta.256 OS: Darwin arm64 25.5.0 ### For AI issues: which model did you use? Grok 4.5 High ### Does this stop you from using Cursor Sometimes - I can sometimes use Cursor ---
**Author:** ![mohitjain](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/mohitjain/32/100229_2.png) [@mohitjain](https://forum.cursor.com/u/mohitjain)\ **Post date:** [July 15, 2026, 10:37am UTC](https://forum.cursor.com/t/permissions-json-allowlists-disable-auto-review-with-sandbox-contradicts-docs/165722/7 "2026-07-15T10:37:48Z")
Hey there, I can reproduce it: a non-empty `terminalAllowlist`/`mcpAllowlist` in `~/.cursor/permissions.json` locks out Auto-review (with Sandbox), not just Run Everything, and the banner only calls out Run Everything. That’s on us, and it contradicts the [permissions.json reference](https://cursor.com/docs/reference/permissions) and [Run Modes](https://cursor.com/docs/agent/security/run-modes), which describe `terminalAllowlist` and `autoRun` coexisting under Auto-review. I’ve reported it to the team, including the misleading tooltip. Workaround to keep Auto-review plus classifier steering today: leave your `autoRun` instructions in `permissions.json`, but move `terminalAllowlist`/`mcpAllowlist` into Settings → Agents → Approvals & Execution. Auto-review stays selectable and your `autoRun` steering still applies. The catch is the literal allowlist array can’t be checked in that way, which is exactly the piece a fix should restore. And yes, avoid `approvalMode: "unrestricted"`- it isn’t a supported field and breaks the Run Mode control. ---
**Author:** ![Jeremiah-England](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/jeremiah-england/32/16320_2.png) [@Jeremiah-England](https://forum.cursor.com/u/Jeremiah-England)\ **Post date:** [September 30, 2026, 6:46pm UTC](https://forum.cursor.com/t/permissions-json-allowlists-disable-auto-review-with-sandbox-contradicts-docs/165722/8 "2026-09-30T18:46:02Z")
We have a `cursor-setup` script we share at our company that adds certain MCP tools to the allow-list in `permission.json`. Pretty unfortunate that is incompatible with auto-review… ---
**Author:** ![haagendazs](https://avatars.discourse-cdn.com/v4/letter/h/7bcc69/32.png) [@haagendazs](https://forum.cursor.com/u/haagendazs)\ **Post date:** [October 1, 2026, 11:03am UTC](https://forum.cursor.com/t/permissions-json-allowlists-disable-auto-review-with-sandbox-contradicts-docs/165722/9 "2026-10-01T11:03:38Z")
@mohitjain This issue is now about 3 months old - are there any updates from the Cursor side of things? ---
**Author:** ![Jeremiah-England](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/jeremiah-england/32/16320_2.png) [@Jeremiah-England](https://forum.cursor.com/u/Jeremiah-England)\ **Post date:** [October 15, 2026, 8:57pm UTC](https://forum.cursor.com/t/permissions-json-allowlists-disable-auto-review-with-sandbox-contradicts-docs/165722/10 "2026-10-15T20:57:56Z")
Pinging this again… still a problem for us.