Skip to content
Wayland Docs

Autopilot and the Safety Guardrail

Autopilot is the fully unattended execution mode for Wayland. When a conversation is in Autopilot, the agent proceeds without pausing to ask permission for each tool call. Builds, file edits, web lookups, and orchestration steps all run in sequence. You start the task and come back when it is done.

This is useful for long-running workflows that would otherwise require dozens of approvals, and for overnight or background runs. It is the same concept as “full auto” or “YOLO mode” in other agent runtimes, but with one critical difference: Wayland runs Autopilot through an internal mode called autoGuarded rather than raw auto-approve, which means the safety guardrail remains active.

The safety guardrail

Section titled “The safety guardrail”

The guardrail is a classifier that runs on every shell command the agent proposes before it is executed. In Autopilot, tool calls that are read operations, file edits, or ordinary build/package steps are auto-approved without interruption. But if the proposed command matches a catastrophic pattern, the guardrail blocks auto-approval and surfaces a real confirmation to you instead.

The bar is deliberately high. The classifier targets a narrow set of effectively irreversible or machine-destructive operations:

  • Recursive deletion of root (/) or home (~), or any top-level system directory (/etc, /usr, /boot, and so on).
  • rm with --no-preserve-root.
  • Raw writes to a block device (dd of=/dev/...).
  • Filesystem formatting (mkfs).
  • Fork bombs.
  • Recursive permission or ownership changes on root or home.
  • Network-fetched content piped directly into a shell (curl | bash, wget | sh, and similar patterns).
  • Overwrites of core system files (/etc/..., /boot/..., /sys/...).
  • find / -delete (mass deletion from the filesystem root).

Ordinary workflow operations are not flagged: deleting a build directory, running git commands, installing packages, or writing project files. False positives would stall legitimate runs, which defeats the point of Autopilot. When the classifier is uncertain, it allows the command through rather than interrupting.

The classifier operates on shell execute tool calls only. File reads, edits through the edit tool, and non-shell operations are never flagged here; other parts of the approval and workspace-confinement system own those.

What happens when the guardrail trips

Section titled “What happens when the guardrail trips”

If a command matches a catastrophic pattern, Wayland pauses the run and surfaces a confirmation dialog showing the command and the reason it was flagged. You can then:

  • Allow it once: approve the specific command and continue the run.
  • Cancel: stop the run entirely.

The agent does not proceed until you choose. No command in the catastrophic-pattern set is ever silently executed, even in Autopilot.

How Autopilot relates to approval modes

Section titled “How Autopilot relates to approval modes”

Wayland has a spectrum of approval modes for how it handles tool calls:

  • Default: the agent pauses and asks for permission on each tool call.
  • Accept Edits: file edits are auto-approved, but command execution still prompts.
  • Autopilot (autoGuarded): all tool calls are auto-approved, except those the guardrail flags.

Autopilot is not the same as the raw bypassPermissions mode available in some runtimes, which runs every command without any check. autoGuarded is strictly safer: it auto-approves only what is not in the catastrophic set, and the guardrail intercepts the rest.

For the approval modes available on the Wayland Core CLI, see Approval Modes.

Next

Section titled “Next”