I want you to think of approval workflows as training wheels that you gradually remove. The tools.exec.ask field controls when your agent asks for human approval before running a command. Set it to "always" during initial setup so you see every tool call. Once you trust the agent's behavior, switch to "unsafe" so it only asks before running commands not on the safe binaries allowlist.
What goes on the safe binaries allowlist? Start with read-only commands like ls, cat, and git status. Add write commands only after you've watched the agent use them correctly. This graduated approach prevents your agent from running rm -rf / on day one.