Prism AIPermissions

Modes

One dropdown in the chat input decides what the agent may do without asking. Readonly never touches your tabs, Approve shows every change as a diff first, Auto applies and runs on its own. The default is Approve.

chat input → mode

The selector sits at the left of the input. It's disabled while a response is streaming.

What each mode permits

Reading never needs permission in any mode: the agent can inspect tabs, browse the schema, validate SQL with a dry run, sample a table, and read the BigQuery docs. The mode only gates the two things that cost money or change your work: scanning data and writing to a tab.

	Readonly	Approve	Auto
Read tabs, schema, docs; validate SQL	Yes	Yes	Yes
Run a `SELECT`	After you click Run	After you click Run	Immediately
Edit SQL in a tab or cell	Refused	Diff, then Apply	Immediately
Create or rename tabs and cells	Refused	Yes	Yes

The mode is sent with every message, so you can change it mid-conversation. Switch to Readonly while you explore, back to Approve when you want changes.

Approve

An edit arrives as a pending diff in the attached tab. Nothing is written until you decide:

Query 1 · pending edit

1234

SELECT vehicle_id, make, model, completed_date
FROM `ace-analytics.warehouse.fact_mot_test`
WHERE completed_date >= DATE_SUB(CURRENT_DATE(), INTERVAL 30 DAY)
AND test_result = 'FAILED'

Apply writes it to the tab; Reject discards it and tells the agent so it can try another approach.

A query arrives as a card with the dry-run estimate:

chat → approval card

Run query?

Dry-run: 1.2 GB · ~$0.006 · up to 100 rows

1234

SELECT make, COUNT(*) AS failed
FROM `ace-analytics.warehouse.fact_mot_test`
WHERE test_result = 'FAILED'
GROUP BY make ORDER BY failed DESC LIMIT 20

RejectRun

Estimate first, scan second. Reject sends the refusal back to the agent.

The agent is told that the buttons are the confirmation, so it doesn’t also ask “shall I proceed?” in the chat.

Readonly

The agent can answer questions, explain, diagnose, and validate, but any call to change a tab is refused with a note that you’d need Approve or Auto. Queries still work, with the same Run card as Approve. It’s a read-only mode for your tabs, not for BigQuery.

Use it when you want a second opinion on a query you don’t intend to change, or when someone else’s tab is open.

Auto

Edits land in the tab and queries run as soon as the agent decides to. The agent’s own guard rails still apply: it dry-runs SQL before executing, only SELECT is allowed, and every query respects the tab’s per-query limit and your budgets. Each edit_sql keeps one level of undo (Revert on the edit card), and the editor’s own undo history is intact.

Limits that apply in every mode

25 tool calls per request. Past that the panel shows Iteration limit reached with a Continue button; continuing counts as one more request against your quota.
A tool that keeps failing, or the same call repeated, stops the loop and the agent explains what happened.
Queries the agent runs are SELECT-only and go through the same dry run, limits, and budgets as your own.