Full auto: approvalMode is unrestricted, web search is auto-accepted, and the sandbox is disabled. Two of those three change something and one does not, which is worth saying because a posture that restates a default grants nothing while…

[Catalog](/en/ai/catalog)

[Publisher](/en/ai/publishers/account_01KZET6ZKJN7S72T5H4WDV62T0)

- stable_id: setup_01M18ZRQB9Y1NTQMMK3QNRTW05

- version: 1.2

- digest: sha256:625201db01be1c61e34272910c70e6f3028d8c07852a788dd847d7792e7a6b59

- harness: cursor

- Purpose: Full auto: `approvalMode` is unrestricted, web search is auto-accepted, and the sandbox is disabled. Two of those three change something and one does not, which is worth saying because a posture that restates a default grants nothing while reading as though it grants a great deal. Measured against the pinned 2026.08.25-3e8eec8 bundle, whose own default configuration literal is `{approvalMode: "allowlist", autoAcceptWebSearch: false, sandbox: {mode: "disabled", networkAccess: "user_config_with_defaults"}}`. So `approvalMode` and `autoAcceptWebSearch` both move off their defaults -- the second is a tool the product otherwise asks about every time, declared in the bundle as a boolean defaulting to false -- while `sandbox.mode: "disabled"` restates the default and is kept only so the posture survives the product changing it. `sandbox.networkAccess` accepts `user_config_with_defaults`, `user_config_only` and `allow_all`, and is deliberately not set: it governs a sandbox this posture switches off, so writing the most permissive value would be a key that reaches nothing. `attribution` defaults to attributing commits and pull requests to the agent and is left alone, because it sends something outward rather than granting you a tool. Instructions travel as a plugin rule, the way the CLI reads one. This is a setup posture -- keys in this product's own configuration file. It is not an execution profile and it grants no environment: what it changes is what the product asks you and which of its own tools exist, not what anyone is permitted to run. The key measurement behind this posture: the default configuration literal in the pinned 2026.08.25-3e8eec8 bundle, and `autoAcceptWebSearch: z.boolean().default(false)` in its own schema. **And the sandbox has a second input this posture does not write.** Measured 2026-08-30 in the same bundle: the product also reads `join(homedir(), ".cursor", "sandbox.json")` -- a separate policy file carrying `additionalReadwritePaths`, `networkPolicy`, `disableTmpWrite` and `enableSharedBuildCache`, resolved from the process home rather than from `CURSOR_CONFIG_DIR`, and relocatable by an administrator through the resolved permissions' `userSandboxDataFolderName`. This posture writes one key in one file; it does not disable a sandbox that file may configure, and it cannot see that file at all. What is said here is what these three keys do.

- Target role:

- posture: full-auto

- trust_lane: authoritative

- author_verified: Yes

- component_verified: Yes

- Lifecycle: active

- Author: account_01KZET6ZKJN7S72T5H4WDV62T0

- Tags: code-review, devops, planning

- install: ai-stp registry version --kind setup --id setup_01M18ZRQB9Y1NTQMMK3QNRTW05 --version 1.2