In Devin Local two settings are often merged into a single "autonomy dial", and that is the first mistake. There are in fact two, and they are orthogonal: agent mode answers what the agent does, while permission mode answers which of that runs without approval. Confusing the axes is what breeds most complaints about an agent that is "too timid" or "too reckless".

The naive model is clear: there is one slider from cautious to autonomous, and sliding it makes the agent bolder in everything at once. From it grows the expectation that "turning on Plan" makes the agent safer, and that "allowing everything" also puts it into planning mode. The expectation is convenient and wrong.

It breaks on the fact that the axes answer different questions. Agent mode is Normal, Plan or Ask: standard execution, a plan before acting (/plan), or answering a question without code changes (/ask). It is about the approach to the task. Permission mode is Normal, Accept Edits, Smart, Bypass or Autonomous: it is about which tool calls pass without a prompt. Ask mode allows and forbids nothing - it simply does not touch the code; Bypass plans nothing - it only removes approvals. The two axes are even set differently: agent mode is switched with slash commands like /plan and /ask right in the course of the dialog, while permission mode is chosen separately, as the level of trust for the session.

It is convenient to lay them out on one table showing how permission mode treats two kinds of action - editing the workspace and shell or fetch. Normal prompts for both. Accept Edits applies edits automatically but prompts for shell. Smart applies edits and, for everything else, has a fast model decide whether it is safe to run without asking, and risk always prompts. Bypass automates everything. Autonomous automates shell and fetch inside a sandbox, but direct editing still prompts. Normal is itself non-uniform: it lets reads in the current directory pass silently but asks for writes and execution, so even the "ordinary" mode already draws a line between observing and intervening.

Why it is split into two axes rather than reduced to one slider. Because "what to do" and "how freely" are independent decisions. You can explore unfamiliar code cautiously through Ask or already knowing the area through Normal, and that is not about permissions. You can grant autonomy narrowly, for edits only, or broadly, with shell in a sandbox, and that is not about approach. One slider would tie together the untied and rob you of half the useful combinations - for instance, planning with auto-applied edits, or standard execution under strict deny.