Approvals and safety

Two separate settings decide what an agent can do. The access mode decides when it must ask you. The permission level decides what is possible at all in a project. Both start at sensible defaults.

Access modes

The current mode is shown in the message box. Full access is highlighted in a warning colour so it is never a surprise.

Permission levels

Set the default under Settings → Permissions, and override it for one project there too.

What always asks first

• Paths that leave the project folder are rejected outright.
• Dangerous commands ask, even in Full access.
• Secrets and git internals (.env files, keys, .git) ask, even in Full access.
• A folder that ships its own hooks or tools asks for your trust once, and lists exactly what would run. Until you agree, they do not run.

When you say no

A denial ends that line of work. The agent is told you said no and is told not to try the same thing another way, and a helper agent it creates cannot have more tools than the agent that made it. A denial in one part of a run applies to the rest of that run.

Run commands in a container

By default the safety is a guard, not a virtual machine. For stronger separation, go to Settings → Safety → Run commands in isolation for the project. Choose where commands run:

• On this computer (the default).
• In a Docker or Podman container. The project is mounted read-write and nothing else is, the network is off unless you allow it, and your computer’s environment variables are not passed in.
• In a bubblewrap sandbox inside a WSL distribution.

Check it works tells you in plain words whether the tool is installed and running. If the runner cannot start, the command is not run at all; it never falls back to your computer. Only commands are isolated: the Terminal tab, the dev server, git, hooks, MCP servers and the file tools still run on your computer.

Undo is always there

Every file change shows who made it, and every change can be reverted. You can also rewind the whole project to before any message. See Review changes and undo.

When nobody is watching

Goals, scheduled tasks and the command line run without you, so their rules are stricter: they never wait for an approval and never grant one. Anything that would ask is denied and listed in the report. They never use Full access, and every run has a time limit and, for priced models, a money limit. Protected paths and project trust apply unchanged.