Security and permissions

Permission cards

Digital workers request approval before sensitive actions:

• Running commands
• Editing files
• Accessing locations outside the workspace
• Calling external systems

The card shows the exact command, path, or target. Choose allow once, always allow, or deny.

Permission modes

• Ask every time: every sensitive action prompts.
• Allow by default: execute within the allowed scope; suitable for controlled environments.
• Enterprise policy: pushed by administrators and takes precedence over personal settings.

In enterprise policy, deny rejects without a prompt, ask prompts, and allow proceeds.

Allowlists

Add commands, tools, or folders to an allowlist to reduce repeated prompts. An allowlist only affects matching actions; it does not expand the workspace.

Enterprise security policies

Administrators can:

• Configure command-level policies by role and directory.
• Block high-risk commands (such as rm -rf or bulk deletes).
• Restrict accessible folders and external systems.
• Push policies to clients centrally.

Restart the local service after a policy change for it to take full effect.

Credentials stay local

Passwords and keys are encrypted on the machine; models only receive one-time handles. When a digital worker signs in to a website, database, or CLI, the credential broker injects the secret instead of handing plaintext to the model.

Unattended tasks require explicit authorization; without it they return input-required and never prompt.

Audit

Tasks, verification, permissions, credential use, and external calls are logged. Administrators can inspect them by user, time, or task.

Recommendations

• Do not paste plaintext passwords into tasks.
• Keep only the files needed for the current project in the workspace.
• Review allowlists and unattended grants regularly.
• Keep human confirmation for high-risk actions.
• Revoke accounts and grants when someone leaves or changes roles.