Session permission modes

Open Settings → General → Permissions to set the default for new research sessions. Manual Approval asks for an operator decision on shell commands. Auto-Review sends a command through the configured reviewer and fails closed when that review cannot run. Danger Mode permits shell execution without per-command approval and must first be enabled in Settings.

Guardian is a separate option: when Auto-Review denies a command, the lead model may independently review the complete command and approve it once if safe. If it denies the override, the reason returns to the session agent. Review the selected mode in New Research before starting a session; a default does not make target code safe.

Execution posture

Beale and app-server run with the privileges of the current host user. Builds, tests, generated proof code, fuzzing, and closed-source executables use those privileges unless you launch the host inside your own VM or container. Authorized scope is recorded in the workspace; network controls and isolation belong to the environment you manage.