Kiro CLI 2.36.0 Adds Approve for Me, Which Judges Actions No Rule Settles in V3 Sessions, and Subcommand Approval Rules
Kiro's 2.36.0 changelog adds Approve for me to interactive V3 sessions; its docs say it judges only actions no rule settles and does not replace security controls.
Overview
Kiro CLI 2.36.0, dated October 29, 2026 in the Kiro changelog, adds a feature called “Approve for me” to interactive V3 sessions. The changelog says “Kiro approves routine actions for you, blocks risky ones, and asks when unsure.” Release 2.37.0 followed on October 30, 2026.
What We Know
How Approve for me works. According to the 2.36.0 changelog, existing deny, ask and allow rules decide first, and Approve for me handles only actions those rules leave unsettled. Each action it approves is marked “Approved for you.” The Kiro permissions documentation states the rule order as “deny > ask > allow > evaluate” and says the preset works through the evaluate effect, which sits last in that chain.
Who judges the actions. The documentation says “Approve for me currently uses Claude Sonnet 4.6 to judge each unsettled action.” It adds that Kiro “asks whenever it is unsure, and whenever the trust classifier is unavailable.”
How to turn it on. In an interactive V3 session, a user runs /permissions and chooses Policies. The changelog says the option appears only when available; where it is unavailable, “Kiro keeps asking.” The choice is stored per workspace as an approve-for-me policy preset in the workspace permissions file. The documentation says the /permissions command is not available in cloud sessions.
What it still does not cover. The documentation says the preset allows workspace reads and writes and read-only shell commands outright, so those never wait for a verdict. It also says a file operation outside the workspace “is not judged by Approve for me and keeps its ordinary prompt.” Unlike --trust-all-tools and /tools trust-all, the documentation says, Approve for me “can still block an action or ask you.”
Stated limits. The documentation states: “Approve for me does not replace your security controls.” It recommends keeping deny rules for actions that should never run and turning on the local command sandbox so an approved command is also limited in what it can reach.
Other Approval Changes in 2.36.0 and 2.37.0
- Subcommand rules. The 2.36.0 changelog says that when a V3 session asks about a shell command such as
git stash pop, the rule picker now offers a choice between the exact command and broader rules. The documentation lists three tiers for that command: exact match (git stash pop), subcommand (git stash *) and pattern (git *). It says Kiro offers neither pattern tier for a command that starts with a privilege or environment wrapper such assudoorenv. - Warnings on upgrade. Per the changelog,
kiro-cli agent upgradenow warns when the upgraded rules deny, hide or ask for something V2 allowed. - Git config variables. The changelog says that in V2 sessions, a shell command that sets git configuration through an environment variable such as
GIT_CONFIG_GLOBALnow asks for approval before it runs. - Automatic agent upgrades. The 2.37.0 changelog says automatic V2 agent upgrades are now on by default when a V3 session starts, and that each agent file is rewritten in place after a
.json.bakbackup is saved. Runningkiro-cli settings chat.enableAutoAgentUpgrade falsekeeps agents in V2. - Shorter prompts. The same changelog says V3 approval prompts in the main chat show only the first line of a multi-line command, with Ctrl+O revealing the rest.
What We Don’t Know
The sources do not say what share of actions the judging model approves, blocks or escalates, or how Approve for me performs against adversarial input. The documentation does not describe the criteria the model uses to decide that an action is routine or risky. No independent evaluation of the feature was found; all three sources are Kiro’s own changelog and documentation pages.
Context in Herald Coverage
The Machine Herald has covered other agent permission modes: GitHub Copilot Assisted Permissions Reach General Availability in the CLI, App and VS Code, With Separate Enterprise Switches for Allow-All and Claude Code Makes Auto Mode Its Default Starting Permission Mode on Every Plan and Provider. Those articles describe other products; the Kiro sources cited here do not compare Approve for me with them.