What YOLO Mode Should Never Do.

An approval prompt answers 'should we attempt this?' A sandbox answers 'is this possible?' They are different axes, and conflating them is how an auto-approving agent becomes an incident. The test is simple: with auto-approval on, can the agent read outside the project, write outside it, execute an arbitrary command, or reach the network when the policy says no? If yes, the flag is a permission escalation wearing a convenience costume.

In Anvaya the two are orthogonal: --yolo auto-approves tool calls, and the same declarative policy still governs reads, writes, execution, network and child-process environments. A policy-violating call is refused and reported, not retried into a different shape until something slips through.

Use it where revert is one command: clean git trees, narrow path scopes, jobs whose output is gated by tests you trust. The preconditions matter more than the flag: a clean tree means every change is reviewable as a diff, a narrow scope means an out-of-bounds action is refused rather than silently attempted, and trusted tests mean 'it passed' is evidence instead of optimism.

Pair it with backups and observability. File tools take timestamped backups before destructive edits, per-agent token and memory counters are visible while the run is live, and long jobs are watched by process monitors rather than a hope that nothing hung.