Some 2025 Amp installation guides describe editor-sidebar workflows and explicit prompts before tools run. Both assumptions changed in 2026. Amp announced the end of its VS Code and Cursor extensions and then launched a redesigned CLI, Neo, in May. Most importantly for security-conscious teams, Amp described a default in which tools run without approval unless a permission mechanism is configured.
What the official product can and cannot do
The Neo announcement describes remote control, automatic conversation compaction and a plugin API for tools, commands and lifecycle events. Earlier tool-level permission rules supported allow, reject, ask and delegated decisions. The May announcement explains that the old permission system is retained as a plugin for configurations that opt in. Therefore a policy suitable for the 2025 client must be revalidated under the current CLI behavior.
A practical evaluation workflow
Provision a disposable working tree under an unprivileged account. In a staging terminal, configure a plugin that denies shell access to protected directories and requires explicit confirmation for writes or network calls. Verify the policy using harmless synthetic commands and a repository containing prompt-like untrusted comments. Record whether both interactive and noninteractive executions apply the policy, then lock down plugin distribution through team configuration.
Limitations and historical pitfalls
Text matching a command string is not complete process isolation. Shell scripts can call other binaries or fetch remote code; an agent can alter files and then invoke a build system whose hooks execute scripts. Remote control introduces a separate authentication and session-sharing surface. Automatic compaction changes how history is summarized but does not prove safe retention, correct memory or reproducible debugging.
Data handling and permission boundary
Treat the CLI’s host process, available secrets, working directory, network access and registered plugins as the real security boundary. Run with no cloud-production tokens, limited filesystem permissions and a network egress policy. Record changed files plus action logs; a polite assistant message that it sought approval is not evidence that the runtime enforced one.
Who should use this approach
Amp is worth investigating when terminal-first agents and plugin-built controls match team workflows. It is inappropriate to onboard under a generic statement that every potentially destructive action prompts by default. Organizations needing centralized policy enforcement should demonstrate real denial behavior before attaching sensitive repositories.
Alternatives and trade-offs
Claude Code, Codex CLI, Goose and Plandex offer different permission and sandbox arrangements; their latest documentation must be evaluated separately.
Version, tier, region and evidence status
This article is an editorial snapshot checked against first-party material on 2026-10-25. Version or historical applicability: Editor extensions removed 2026-03; Neo CLI announced 2026-05-06. The exact software build in a reader’s organization, eligibility by country, enterprise agreement, separate provider model rates, code retention and full regional list have not been validated; such fields remain unknown rather than being guessed. Product statements are attributed to first-party descriptions, not independent hands-on tests. License guarantees, prices and seat limits require AI 10 dated snapshots or signed terms. Unverified details do not become timeless facts because they appear in current online documentation.
Deployment acceptance checklist
- Write the intended job and acceptance criteria; record the installed client release, plugin publisher, connected model/provider and tenant.
- Use a consented test repository with zero real secrets; capture installation permissions, processor regions, Git App grants and available audit logs.
- Verify the task boundary with a test that should fail when unauthorized: blocked file, network host or protected branch.
- Review proposed changes or comments against known requirements; run regression, security and integration checks independently of the agent.
- Document the owner, offboarding procedure, rollback limits and whether a formal procurement/privacy sign-off is still pending.
Sources & Further Reading
- https://ampcode.com/news/the-coding-agent-is-dead (official technical material; undated/living source; checked 2026-10-25)
- https://ampcode.com/news/neo (official technical material; original date 2026-05-06; checked 2026-10-25)
- https://ampcode.com/news/tool-level-permissions (official technical material; original date 2025-08-07; checked 2026-10-25)
- https://ampcode.com/docs/tools (official technical material; undated/living source; checked 2026-10-25)