Blog
Factory Droid --skip-permissions-unsafe: the flag that admits it does not skip everything
Factory's documentation says there is no mode that bypasses all controls. That is unusual enough to be the most useful sentence on the topic, and the flag is built around it.
In Factory's Droid CLI, droid exec --skip-permissions-unsafe skips every permission prompt, and its own help text adds that command blocks still apply. Below it are three autonomy levels, --auto low, medium and high, which approve progressively riskier commands. Droid's sandbox, Seatbelt on macOS with a filtering network proxy, is off by default and independent of both. Forkbench adds the credential half: a key used through Vault never sits in Droid's environment.
Autonomy levels come first
Droid frames permissions as how much it may do alone, and the levels are concrete. With no flag, droid exec runs read-only. --auto low adds file edits and low-risk commands. Medium adds changes that can be reversed, such as installing packages, committing and moving files. High adds the ones that reach further, such as pushing, bringing up containers and running migrations, unless a safety check asks for approval.
In an interactive session, Ctrl+L cycles the level and /settings saves a default.
For most unattended work, a level is the right tool. It says which kinds of action you are comfortable with, rather than every action at once.
What --skip-permissions-unsafe still respects
The flag removes every prompt, and the help text says in the same line that command blocks still apply. A block rule in your command policy has no approval path at all, so no flag can approve it.
Built-in safeguards can still force approval on destructive operations Droid recognises, and an organisation can cap the maximum autonomy level for everyone. Factory's own documentation states there is no mode that bypasses all controls, and recommends using the flag only in disposable containers.
The sandbox is a separate layer
Droid ships an operating-system sandbox: Seatbelt on macOS, bubblewrap with seccomp on Linux and WSL2, and an HTTP and SOCKS proxy that filters network access. It is off by default and enabled with sandbox.enabled: true.
Factory documents the sandbox, the autonomy level and the unsafe flag as independent layers. That is the right design, and it means the sandbox protects you only if you turned it on before you turned the prompts off.
How this works in Forkbench
Forkbench is a desktop app for running coding agents. Droid runs in it as the droid command you installed, with your settings untouched, and reaches the Thread's notes and board through the fb command on its PATH.
Droid already has the layers most CLIs lack, so what Forkbench adds is narrow. A key in Vault is used by the command that needs it without the value entering Droid's environment, which matters at autonomy high, where pushes and migrations are exactly the commands that carry credentials. And a task Droid reports done is a report until a person accepts it, which keeps the human at the end of an unattended run.
The limit: a command you authorise can still use a key against the destination it was bound to. That is containment, not a guarantee.
Related: Yolo mode in every coding agent, compared, Claude Code: what --dangerously-skip-permissions actually skips, When coding agents deleted production databases
Frequently asked
What does droid exec --skip-permissions-unsafe do?
It skips all permission prompts for that run. Command block rules still apply, built-in safeguards can still require approval for destructive operations, and an organisation's autonomy cap still holds.
What are Droid's autonomy levels?
Off, which is read-only and the default for droid exec; low, which adds edits and low-risk commands; medium, which adds reversible changes such as installs and commits; and high, which adds pushes, container starts and migrations. Set them with --auto low, medium or high.
Does Factory Droid have a sandbox?
Yes: Seatbelt on macOS, bubblewrap with seccomp on Linux and WSL2, and a filtering proxy for network access. It is off by default and enabled with sandbox.enabled: true, independently of the autonomy level.
Is there a way to bypass every control in Droid?
No. Factory's documentation states that no mode bypasses all controls. Block rules have no approval path and survive every flag.