permission_control
Whether hooks can make or influence permission decisions determining whether a tool is available for invocation. Minimum qualification: supported when the provider allows hooks to return permission decisions of any kind (grant, deny, or ask). Boundary: permission_control governs whether a tool is available; see decision_control for invocation-flow control.
Type: bool Content type: hooks
Provider Support
Section titled “Provider Support”| Provider | Supported | Mechanism |
|---|---|---|
| amp | ✓ | amp.permissions ordered first-match-wins rule list returns one of allow / reject / ask / delegate for every tool invocation before execution; default fallback is ask on the main thread and reject in sub-agents |
| claude-code | ✓ | hook_permission_update_entries: PermissionRequest hooks return updatedPermissions with addRules/replaceRules/removeRules/setMode entries |
| codex | ✓ | hook_permission_decision: Codex hooks can return permission decisions that grant or deny tool availability |
| crush | ✓ | Hooks run before permission checks. Exit code 2 blocks the tool call entirely, taking effect before the built-in permission gate. |
| factory-droid | ✓ | PreToolUse hooks return allow, deny, or ask in the JSON decision field to bypass, block, or escalate tool permission decisions |
| cline | ✗ | Cline hooks can cancel tool invocations (decision_control) but cannot grant/deny tool availability |
| copilot-cli | ✗ | Copilot CLI hooks can deny tool invocations (decision_control) but do not govern tool availability |
| cursor | ✗ | Cursor hooks control allow/block via exit codes but do not govern tool availability through permission rule updates. |
| gemini-cli | ✗ | Gemini CLI hooks control invocation flow via exit codes but do not govern tool availability |
| kiro | ✗ | Kiro hooks do not participate in permission decisions |
| opencode | ✗ | not documented |
| pi | ✗ | Pi extensions cannot make availability decisions for tools; tool_call block controls invocation flow but does not remove a tool from the available set; setActiveTools() is available but is not a hook return mechanism |
| roo-code | ✗ | not documented |
| windsurf | ✗ | Windsurf hooks do not participate in permission decisions |
| zed | ✗ | not documented |