What are the auto-approval modes?

Three, set globally or per gem: off (approve every tool call yourself), in gem (reads anything, makes changes only inside this gem, runs git that cannot lose work, asks before anything else), and all (approve everything, full speed). Separately, pause auto-approvals in the crystl app menu is a kill-switch that overrides every mode until you resume. See approval modes.