diff --git a/sunbeam/src/code/config.rs b/sunbeam/src/code/config.rs
index 8ebea15..69d59ec 100644
--- a/sunbeam/src/code/config.rs
+++ b/sunbeam/src/code/config.rs
@@ -55,6 +55,35 @@ impl Default for LoadedConfig {
     }
 }
 
+impl LoadedConfig {
+    /// Get the permission level for a tool. Returns "always", "ask", or "never".
+    pub fn permission_for(&self, tool_name: &str) -> &str {
+        match tool_name {
+            "file_read" => &self.file_read_perm,
+            "file_write" => &self.file_write_perm,
+            "search_replace" => &self.search_replace_perm,
+            "grep" => &self.grep_perm,
+            "bash" => &self.bash_perm,
+            "list_directory" => &self.list_directory_perm,
+            _ => "ask", // unknown tools default to ask
+        }
+    }
+
+    /// Upgrade a tool's permission to "always" for this session (in-memory only).
+    pub fn upgrade_to_always(&mut self, tool_name: &str) {
+        let target = match tool_name {
+            "file_read" => &mut self.file_read_perm,
+            "file_write" => &mut self.file_write_perm,
+            "search_replace" => &mut self.search_replace_perm,
+            "grep" => &mut self.grep_perm,
+            "bash" => &mut self.bash_perm,
+            "list_directory" => &mut self.list_directory_perm,
+            _ => return,
+        };
+        *target = "always".into();
+    }
+}
+
 /// Load project config from .sunbeam/config.toml.
 pub fn load_project_config(project_path: &str) -> LoadedConfig {
     let config_path = std::path::Path::new(project_path)