--- a/hgext/directaccess.py
+++ b/hgext/directaccess.py
@@ -21,12 +21,41 @@
 # By default, all the commands have directaccess with warnings
 # List of commands that have no directaccess and directaccess with no warning
 directaccesslevel = [
-    # 'nowarning' or 'error', (None if core) or extension name, command name
-    ('nowarning', None, 'update'),
+    # Format:
+    # ('nowarning', 'evolve', 'prune'),
+    # means: no directaccess warning, for the command in evolve named prune
+    #
+    # ('error', None, 'serve'),
+    # means: no directaccess for the command in core named serve
+    #
+    # The list is ordered alphabetically by command names, starting with all
+    # the commands in core then all the commands in the extensions
+    #
+    # The general guideline is:
+    # - remove directaccess warnings for read only commands
+    # - no direct access for commands with consequences outside of the repo
+    # - leave directaccess warnings for all the other commands
+    #
+    ('nowarning', None, 'annotate'),
+    ('nowarning', None, 'archive'),
+    ('nowarning', None, 'bisect'),
+    ('nowarning', None, 'bookmarks'),
+    ('nowarning', None, 'bundle'),
+    ('nowarning', None, 'cat'),
+    ('nowarning', None, 'diff'),
     ('nowarning', None, 'export'),
-    ('nowarning',  'evolve', 'prune'),
-    ('error', None, 'push'),
+    ('nowarning', None, 'identify'),
+    ('nowarning', None, 'import'),
+    ('nowarning', None, 'incoming'),
+    ('nowarning', None, 'log'),
+    ('nowarning', None, 'manifest'),
+    ('error', None, 'outgoing'), # confusing if push errors and not outgoing
+    ('error', None, 'push'), # destructive
+    ('nowarning', None, 'revert'),
     ('error', None, 'serve'),
+    ('nowarning', None, 'tags'),
+    ('nowarning', None, 'unbundle'),
+    ('nowarning', None, 'update'),
 ]
 
 def reposetup(ui, repo):