10 · Permission modes and the sandbox

If you read one chapter, read this one

WorkBuddy reads and writes files, tidies directories and generates documents. It can also run scripts and external programs. That is where its value comes from, and it is the only place it can genuinely hurt you.

This chapter is about drawing the boundary without giving up the speed.

Two permission modes

WorkBuddy offers default permissions (默认权限) and full access (完全访问权限).

Use default permissions day to day: the AI works efficiently inside the workspace, but stops to ask you before anything high-risk.

Think of it as a guardrail — out of the way during ordinary work, insisting on a second look when a boundary is about to be crossed or something dangerous is about to happen.

Where to switch

The permission control sits at the bottom of the input box as a persistent status button, showing "default permissions" by default. Clicking it opens a panel with an "allow full access" toggle.

The permission state is always visible above the input box, so you can check which tier you are in before starting anything.

What a workspace is

The workspace is the folder this task mainly reads from and writes to — the directory you pick when creating a task, or the one WorkBuddy creates for it.

Put the files this task needs into one workspace:

• weekly-report
• invoice-archive
• client-data-cleanup
• photo-batch

That makes file handling smoother, and lets default permissions judge more accurately which operations belong to this task.

A sandbox is not a backup

Before working on anything important, make a dedicated folder and put only copies in it.

Default permissions reduce accident risk; they do not replace backups. Different jobs: the guardrail stops "it did something it should not have", a backup covers "it did the right thing badly".

What default permissions protect

Under default permissions the focus is important assets and high-risk actions. With delete protection on, ordinary file writes usually proceed; but sensitive paths, significant deletions, script commands and network operations still stop for confirmation.

Typically confirmed:

Operation	Why
Writing to a protected or sensitive path	Avoid overwriting keys, credentials or security configuration
Deleting protected files, important directories, or bulk deletion	Avoid losing hard-to-recover material; ordinary single-file deletion is usually covered by delete protection
Running scripts, commands or external programs	Can modify files, reach the network or affect the system
Network access or sensitive capabilities	Hitting a Security Centre rule or a high-risk capability triggers confirmation

If you cancel, WorkBuddy does not perform that step. You can keep talking and have it find a safer route — listing the files it intends to delete first, or saving results inside the workspace.

The sandbox adds further layers:

• Commands run under sandbox constraints first; if blocked, risk determines whether you get asked
• Delete protection uses safe deletion or the recycle bin where it can
• File backup saves a snapshot before modifying an existing file; new files are not backed up repeatedly

Why this beats "have the AI review the script"

A common alternative is to have the AI read a command or script and judge whether it looks dangerous.

The problem is that real execution risk comes from many places:

• The script calls other scripts or tools
• File paths are generated at runtime and are not visible up front
• An ordinary command can delete, overwrite or move a great deal depending on its arguments
• An external program's real behaviour cannot always be inferred from script text

Default permissions do not stop at "what does this look like". They ask again at the moment WorkBuddy is about to perform something high-risk. Even where ordinary file writes flow smoothly, the moment the next step meets a confirmation condition, the decision comes back to you.

How to read a confirmation dialog

Three things to look at:

1. The operation — writing a file, deleting a file, or running a script
2. The blast radius — is the target path inside this task's workspace, or does it touch the desktop, downloads, project source or other important directories
3. The reason — is this step genuinely necessary for the task

When unsure, cancel

Cancelling is not failure. Afterwards you can ask for:

• A list of the files it intends to modify or delete
• A preview or a backup first
• Output saved inside the workspace
• The script explained before it runs

Those sentences cost fifteen seconds — far cheaper than recovering files.

Full access

Full access turns off the second confirmation. High-risk operations then proceed without asking: writing files, deleting files, running scripts, calling external programs.

It applies to every task in this client

The most misread point: it is not scoped to the current task.

Turning it on switches every existing task and every task created afterwards in this client; turning it off mid-conversation returns them all to the default confirmation flow. It does not carry across devices — each client is managed independently.

Switching brings up "confirm full access?", listing exactly what opens up (file operations, terminal commands, internet access) and warning that all tasks will have fewer confirmation steps and will act directly on your computer. Make sure the current task and files are recoverable before ticking the risk acknowledgement.

Full access is not safer

It does not automatically assess risk for you. It hands the confirmation step to the AI to pass automatically.

Use it only on completely trusted tasks, isolated environments or temporary test directories — Docker, a VM, a throwaway working directory.

Do not enable it when:

• You are handling production, client or financial material, or a sole copy
• The working directory is near the desktop, downloads, your documents root or a repository root
• The task will bulk delete, bulk rename or overwrite files
• The task runs scripts or third-party tools you do not understand
• There are important files on this computer with no backup

Comparison

Aspect	Default permissions	Full access
File access	Inside the sandbox; crossing needs approval	Anywhere on the computer
Delete / modify	Confirmed each time	Mostly direct
Terminal commands	System-level commands confirmed	Runs commands, installs software, changes system settings
Internet	Controlled; sensitive actions confirmed	Visits sites, sends data, uses enabled connectors
Interruptions	Higher	Very low
Scope	Current task	Global, all tasks
Risk	Low	High

By situation:

Situation	Recommendation
Everyday documents, spreadsheets, file tidying	Default permissions
First time handling a class of task, or the goal is unclear	Default permissions, and have it plan first
Bulk delete, move or overwrite	Default permissions, and check paths and lists carefully
Running trusted scripts repeatedly in an isolated directory	Full access briefly is reasonable
Experimenting in Docker, a VM or a temporary environment	Enable as needed
Production, important machines, sole copies	Do not enable

Recommended practice

1. Pick the workspace first — a separate folder per task
2. Back up important files — especially for bulk, delete and rename work
3. Stay on default permissions — let it stop at the risky moments
4. Read the dialog before continuing — operation, path, blast radius
5. Cancel when unsure — ask for an explanation, a preview or a list
6. Turn full access off when done — brief use, trusted, isolated, recoverable

The goal is not to make you confirm constantly

It is one extra confirmation exactly where the loss would be worst. Most everyday tasks continue automatically; only actions that could really change your computer's state come back to you.

The Security Centre

The Security Centre gathers security and runtime configuration. Beyond the two permission modes, you can tighten the agent's boundaries further here.

Program blocklist

Under command security, programs on the blocklist cannot be launched by the agent or by anything it calls.

• For programs you never want the AI touching
• Blocked calls are refused outright — you are not asked

The difference from a confirmation dialog: a dialog asks; the blocklist simply refuses. Put things there that should never be touched under any circumstances.

File read/write rules

Under the forced-approval blocklist, set interception rules for sensitive directories:

Rule	Behaviour
Write	Prompts before writing a file
Read/write	Prompts before both reading and writing

Three details:

• Tools that only touch filenames without reading content (like find) do not trigger a prompt
• Tools that read file content (like grep) are governed by the read rule
• The default rules already include read protection for sensitive directories such as ssh

Worth adding

• Your password manager's data directory
• Directories holding .env files, keys and certificates
• Financial, legal and HR material
• Anywhere whose contents should never enter a model context

Automatic backup

With automatic backup on under sandbox security, the agent takes a snapshot before modifying an existing file; new files are not backed up repeatedly. With it on, file modifications proceed without a prompt each time.

Details:

• Within one conversation turn, a file gets one snapshot, before its first modification
• Click "open backup directory" to see this session's backups
• All sessions share the backup space, capped at 3000 MB by default; when full, the oldest backups are cleared first

Keep it on, but do not treat it as your backup strategy

Automatic backup is on by default and should stay on. It does not replace your own backups — it exists so you can roll back quickly when the agent gets something wrong.

The 3000 MB cap and the oldest-first cleanup mean that after several days of heavy work, early snapshots may already be gone.

Malicious-domain blocking

WorkBuddy carries a built-in malicious-domain list. Before network access from inside the sandbox (scripts, command line) or before fetching a web page, it checks the target domain and refuses on a match.

• The check happens entirely locally — no request goes to a backend per access
• The list updates daily; on a failed update the previous version continues to be used
• Covers network access and page fetching inside the sandbox; does not cover network access inside plugins, or search services

That last clause is the boundary: a third-party plugin's own network requests are not protected by this. It is another reason Skill security review matters.

FAQ

Do default permissions stop the model doing anything useful?

No. Ordinary operations inside the sandbox proceed normally; only boundary crossings and high-risk types need confirmation. Writing, analysis and document generation are essentially unaffected.

Does full access apply only to this task?

No. It is a global switch covering all tasks, including ones created afterwards.

Can I turn full access back off?

Yes. Return to the permission panel at the bottom of the input box and switch "allow full access" off.

Does it ask about every single step under default permissions?

No — only operations that leave the sandbox or fall into high-risk categories (deletion, modification, system commands, outbound sending).

Files seem to have gone missing after tidying my desktop.

A known Windows behaviour. Check the target directory and the recycle bin first; important desktop files should have been backed up before running it. Keep the generated script and result screenshots for investigation.

The more fundamental advice: do not have it tidy the desktop. The desktop is a mixed directory — pull what you want tidied into its own folder first.

Next

11 Git and parallel worktrees — isolation for developers.