Security boundaries
Permission modes and the Workspace, Approval, network, and secret execution boundaries.
Security boundaries run before an action. They do not rely on a prompt asking the model to be careful.
Permission modes
| Mode | Purpose |
|---|---|
SAFE | Uses explicit approval to protect risky actions by default. |
SMART | Reduces low-risk interruptions inside established policy. |
AUTOPILOT | Raises authorization for more continuous, controlled execution. |
YOLO | The highest authorization level; use only when you understand the impact. |
Modes do not disable non-bypassable safety boundaries.
Workspace
File tools can only access the configured Workspace. Path validation happens before the filesystem operation and does not depend on model compliance.
Shell and approval
Shell receives a program name and argument array, never a concatenated command string. Approval for a risky action binds exact argv. Changing arguments requires a new decision.
HTTP and secrets
The HTTP tool applies SSRF protection against disallowed local and internal targets. Secrets stay out of prompts, ordinary logs, and Memory, and should never appear in screenshots or issue reports.
Do not remove gates for a demo
When a hard boundary rejects an action, change the requested scope or configuration. Do not remove checks, weaken assertions, or bypass Policy.
The repository architecture and tests remain authoritative.