diff --git a/pkg/config/config.go b/pkg/config/config.go
index acceee4d5..a2a0b6f7e 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -762,11 +762,12 @@ type CronToolsConfig struct {
 
 type ExecConfig struct {
 	ToolConfig          `         envPrefix:"PICOCLAW_TOOLS_EXEC_"`
-	EnableDenyPatterns  bool     `                                 json:"enable_deny_patterns"  env:"PICOCLAW_TOOLS_EXEC_ENABLE_DENY_PATTERNS"`
-	AllowRemote         bool     `                                 json:"allow_remote"          env:"PICOCLAW_TOOLS_EXEC_ALLOW_REMOTE"`
-	CustomDenyPatterns  []string `                                 json:"custom_deny_patterns"  env:"PICOCLAW_TOOLS_EXEC_CUSTOM_DENY_PATTERNS"`
-	CustomAllowPatterns []string `                                 json:"custom_allow_patterns" env:"PICOCLAW_TOOLS_EXEC_CUSTOM_ALLOW_PATTERNS"`
-	TimeoutSeconds      int      `                                 json:"timeout_seconds"       env:"PICOCLAW_TOOLS_EXEC_TIMEOUT_SECONDS"` // 0 means use default (60s)
+	EnableDenyPatterns  bool     `json:"enable_deny_patterns"  env:"PICOCLAW_TOOLS_EXEC_ENABLE_DENY_PATTERNS"`
+	AllowRemote         bool     `json:"allow_remote"          env:"PICOCLAW_TOOLS_EXEC_ALLOW_REMOTE"`
+	CustomDenyPatterns  []string `json:"custom_deny_patterns"  env:"PICOCLAW_TOOLS_EXEC_CUSTOM_DENY_PATTERNS"`
+	CustomAllowPatterns []string `json:"custom_allow_patterns" env:"PICOCLAW_TOOLS_EXEC_CUSTOM_ALLOW_PATTERNS"`
+	TimeoutSeconds      int      `json:"timeout_seconds"       env:"PICOCLAW_TOOLS_EXEC_TIMEOUT_SECONDS"` // 0 means use default (60s)
+	AskPermission       bool     `json:"ask_permission"` // NEW
 }
 
 type SkillsToolsConfig struct {
diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
index 4f1c5c5e8..bd374e706 100644
--- a/pkg/config/config_test.go
+++ b/pkg/config/config_test.go
@@ -2432,3 +2432,19 @@ func testChannelsConfigWithTokens() ChannelsConfig {
 	}
 	return channels
 }
+
+func TestToolsConfig_IsToolEnabled_ExecAskPermission(t *testing.T) {
+	cfg := &ToolsConfig{
+		Exec: ExecConfig{
+			ToolConfig: ToolConfig{
+				Enabled: true,
+			},
+			AskPermission: true,
+		},
+	}
+
+	// Verify AskPermission field exists and is accessible
+	if !cfg.Exec.AskPermission {
+		t.Error("Expected AskPermission to be true")
+	}
+}
diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go
index 8e2494ae5..68660d91d 100644
--- a/pkg/config/defaults.go
+++ b/pkg/config/defaults.go
@@ -369,6 +369,7 @@ func DefaultConfig() *Config {
 				EnableDenyPatterns: true,
 				AllowRemote:        true,
 				TimeoutSeconds:     60,
+				AskPermission:      true,  // NEW: enable permission prompts by default
 			},
 			Skills: SkillsToolsConfig{
 				ToolConfig: ToolConfig{