Chat permissions
Every chat has two separate permission settings, both under the sliders icon in the chat: one for commands and file changes in containers, and one for tools the server runs itself. You can change either while the AI is working.
Diagram as text
- The AI calls a server tool. The chat's level is read at that moment, so a switch in the middle of a turn counts for the next call.
- Fixed rules first: a call with an outside effect, one that cannot be undone, one aimed at someone else's address, or one with an unknown price or above 0.50 USD goes to you.
- A free tool with no outside effect runs.
- For everything else a reviewer model answers allow or ask within 3 seconds. An error, a timeout, an unclear answer or no reviewer means it asks you.
- You approve or deny. Approved calls run.
Container commands
Four modes: Ask every time, Allowlisted commands only, Auto-accept edits and Never ask. Never ask needs a second click (Understood, switch). The prompt and the allowlist are described under command approval.
Server tools
The Server tools setting covers jobs the server runs, such as scans, designs and sites, plus the paid helpers for asking another model and for images.
- Run without asking: runs at once, even if it costs money.
- Ask first: an approval card for every call that costs money. Free calls run.
- Automatic review: fixed rules decide first. The chat asks you when a call reaches outside the platform, cannot be undone (delete, publish, deploy, send, pay), points at someone else's address, has an unknown price, or is estimated above 0.50 USD. A free tool with no outside effect runs. For everything else a small reviewer model, the one that also summarises long chats, sees the redacted call and answers allow or ask within 3 seconds. An error, a timeout, an unclear answer or no reviewer available (no balance, anonymous chat, zero-data-retention chat) means it asks you. The card says who decided and why. Reviewer calls are billed to your credit like other internal calls.
- Manual: the AI only proposes. Nothing runs, and the AI is told so and carries on. The chat shows a Start button; press it and the result replaces the proposal in the same row. Start works once, only for the chat's owner, and needs credit. The paid helpers cannot be started later and behave like Ask first.
- A chat with no choice of its own follows its container mode: Auto-accept edits or Never ask gives Run without asking, anything else gives Ask first.
Switching mid-turn
The level is read again for every tool call. Switch the container mode to Auto-accept edits and approvals already waiting in the running turn are granted at once; later calls run unasked, and switching back asks again. For server tools, Run without asking grants the waiting cards and Manual turns them into proposals. While the AI waits in ask mode, a hint offers Switch to Automatic?. Only the owner of the chat can switch.