<!-- https://zerolog.ch/docs/permissions · Docs / Compute -->
# Chat permissions

Every chat has two separate permission settings, both under the sliders icon in the chat: one for commands and file changes in containers, and one for tools the server runs itself. You can change either while the AI is working.

## Container commands

Four modes: **Ask every time**, **Allowlisted commands only**, **Auto-accept edits** and **Never ask**. **Never ask** needs a second click (**Understood, switch**). The prompt and the allowlist are described under [command approval](https://zerolog.ch/docs/approval).

## Server tools

The **Server tools** setting covers jobs the server runs, such as scans, designs and sites, plus the paid helpers for asking another model and for images.

- **Run without asking:** runs at once, even if it costs money.
- **Ask first:** an approval card for every call that costs money. Free calls run.
- **Automatic review:** fixed rules decide first. The chat asks you when a call reaches outside the platform, cannot be undone (delete, publish, deploy, send, pay), points at someone else's address, has an unknown price, or is estimated above 0.50 USD. A free tool with no outside effect runs. For everything else a small reviewer model, the one that also summarises long chats, sees the redacted call and answers allow or ask within 3 seconds. An error, a timeout, an unclear answer or no reviewer available (no balance, anonymous chat, zero-data-retention chat) means it asks you. The card says who decided and why. Reviewer calls are billed to your credit like other internal calls.
- **Manual:** the AI only proposes. Nothing runs, and the AI is told so and carries on. The chat shows a **Start** button; press it and the result replaces the proposal in the same row. Start works once, only for the chat's owner, and needs credit. The paid helpers cannot be started later and behave like Ask first.
- A chat with no choice of its own follows its container mode: Auto-accept edits or Never ask gives Run without asking, anything else gives Ask first.

## Switching mid-turn

The level is read again for every tool call. Switch the container mode to Auto-accept edits and approvals already waiting in the running turn are granted at once; later calls run unasked, and switching back asks again. For server tools, Run without asking grants the waiting cards and Manual turns them into proposals. While the AI waits in ask mode, a hint offers **Switch to Automatic?**. Only the owner of the chat can switch.

## How Automatic review decides one call

Mermaid source of the diagram on this page:

```mermaid
%% Chat permissions: how Automatic review decides one server-tool call. Facts from server/werkzeugstufe.js and server/routes/chats.js.
flowchart TB
  a["1. The AI calls a server tool<br/>level is read at that moment"]
  r["2. Fixed rules first"]:::hot
  h["You decide<br/>approve or deny"]
  run["The tool runs"]
  rev["3. Reviewer model<br/>allow or ask within 3 s"]

  a --> r
  r -->|outside effect, no undo,<br/>unknown or high price| h
  r -->|free and harmless| run
  r -->|undecided| rev
  rev -->|allow| run
  rev -->|ask, error, timeout| h
  h -->|approve| run

  classDef hot stroke:#8f7ac9
```