diff --git a/.changeset/web-agent-permission-order.md b/.changeset/web-agent-permission-order.md
new file mode 100644
index 0000000000..9354bc4d3d
--- /dev/null
+++ b/.changeset/web-agent-permission-order.md
@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+web: Order permission modes from safest to most permissive across settings surfaces, and fix the swapped yolo/auto risk colors in the status panel and mobile settings.
diff --git a/apps/kimi-web/src/components/chat/StatusPanel.vue b/apps/kimi-web/src/components/chat/StatusPanel.vue
index 6d51e61485..3692db3134 100644
--- a/apps/kimi-web/src/components/chat/StatusPanel.vue
+++ b/apps/kimi-web/src/components/chat/StatusPanel.vue
@@ -52,10 +52,11 @@ function permLabel(p: PermissionMode): string {
   return t('status.permissionManual');
 }
 
+// Risk progression matches the Composer: yolo = warning, auto = danger.
 const permColor = computed(() => {
   const p = props.status.permission;
-  if (p === 'yolo') return 'var(--color-danger)';
-  if (p === 'auto') return 'var(--color-warning)';
+  if (p === 'yolo') return 'var(--color-warning)';
+  if (p === 'auto') return 'var(--color-danger)';
   return 'var(--color-text)';
 });
 
diff --git a/apps/kimi-web/src/components/mobile/MobileSettingsSheet.vue b/apps/kimi-web/src/components/mobile/MobileSettingsSheet.vue
index 229c933558..6db85b54a2 100644
--- a/apps/kimi-web/src/components/mobile/MobileSettingsSheet.vue
+++ b/apps/kimi-web/src/components/mobile/MobileSettingsSheet.vue
@@ -71,7 +71,9 @@ function onColorScheme(v: string): void {
   emit('setColorScheme', v as ColorScheme);
 }
 
-const PERM_MODES: PermissionMode[] = ['manual', 'auto', 'yolo'];
+// Tap-to-cycle order follows the same safest → most permissive progression
+// as the Composer menu and Agent settings (manual → yolo → auto).
+const PERM_MODES: PermissionMode[] = ['manual', 'yolo', 'auto'];
 
 // Identity is the model id — display/model names can collide across providers.
 const currentModel = computed<AppModel | undefined>(() =>
@@ -94,10 +96,11 @@ const thinkingOptions = computed(() =>
 const planOn = computed<boolean>(() => props.planMode === true);
 const swarmOn = computed<boolean>(() => props.swarmMode === true);
 
+// Risk progression matches the Composer: yolo = warning, auto = danger.
 const permColor = computed<string>(() => {
   const p = props.status.permission;
-  if (p === 'yolo') return 'var(--color-danger)';
-  if (p === 'auto') return 'var(--color-warning)';
+  if (p === 'yolo') return 'var(--color-warning)';
+  if (p === 'auto') return 'var(--color-danger)';
   return 'var(--color-text-muted)';
 });
 /** Permission sub-line, e.g. "manual · confirm every tool". */
diff --git a/apps/kimi-web/src/components/settings/SettingsDialog.vue b/apps/kimi-web/src/components/settings/SettingsDialog.vue
index 181e4197eb..b2957ba719 100644
--- a/apps/kimi-web/src/components/settings/SettingsDialog.vue
+++ b/apps/kimi-web/src/components/settings/SettingsDialog.vue
@@ -85,7 +85,7 @@ const daemonEndpoint = serverEndpointLabel();
 const backendLabel = computed(() =>
   props.backend === 'v2' ? 'v2 (kap-server)' : 'v1 (server)',
 );
-const permissionModes = ['manual', 'auto', 'yolo'] as const;
+const permissionModes = ['manual', 'yolo', 'auto'] as const;
 // Reuse the Composer's permission labels (status.permission*) so the
 // default-permission names stay in sync with the toolbar.
 const permissionLabelKey: Record<(typeof permissionModes)[number], string> = {