Permissions

Your agents can do more than chat. They can open rooms, schedule tasks, set up other agents, install packages, and change settings. Permissions decide which of those things an agent does on its own, which ones wait for your yes, and which ones it cannot do at all.

You set them once for everyone. If one agent needs to be different, you set that one agent differently.

The three states

Every permission is in one of three states:

• Allowed: the agent does it without asking.
• Ask: the agent asks first. A request card appears, and the action runs only after you say yes.
• Blocked: the agent cannot do it. It does not even see the tool. It is told the area is blocked, and that it can ask you with a request if it really needs something there.

Areas

Permissions come in areas, so you decide about a kind of work rather than about every tool one at a time:

Putting a room away (archiving) is not deleting: the room and everything said in it are kept, and you can bring it back from the room's settings.

Talking in a room is not part of any area. An agent in a room can always post and react there, whatever you set here, because nothing should be able to mute an agent in the middle of a conversation.

Two areas are never Allowed: Safety limits and Reach & secrets. The most they can be is Ask, and their rows show a lock.

Own chat holds one action: an agent asking for its own conversation to be summarized when it fills up. It is Allowed in every preset, and setting another area, like Other agents, never changes it. See When the agent asks for it.

Extension tools holds the tools an installed extension gives your agents. They show up only while the extension is running, and each one's row names the extension it came from. Blocking the area blocks all of them at once. An extension tool that deletes or removes something asks every time, even if you set it to Allowed, and its card never offers Always allow.

Single actions

Each area is made of actions, like "Delete a schedule" inside Tasks & schedules. Under a row, Show individual actions lists them, each with its own switch. A single action you set on its own beats its area, and shows under the row even when the list is closed, for example "Except Open a room: Allowed".

A few actions always show you exactly what they would change, before and after, such as changing which model an agent runs on. Those always ask: their cards never offer Always allow, and they can't be set to Allowed.

An action that deletes or removes something asks even when its area is Allowed. Its line says "Always asks unless you set it here": it runs without asking only if you set that one action to Allowed yourself.

Files & commands

Files & commands is how often an agent stops to check with you while it edits files and runs commands in a conversation. It doesn't use Blocked, Ask, or Allowed. It uses the same three positions as the dial in a conversation:

• Ask first: it asks before it changes anything.
• Act: it gets on with the work and stops for the risky parts.
• Full autonomy: it edits files and runs commands on its own. It will not stop to ask you.

For Codex, the three positions are Codex's own levels. Ask first asks before any change. Workspace write changes the project freely and asks before going further or online. Full access never asks. A conversation can start another one only at its own level or a safer one, so a Claude Code conversation in Ask first can start a Codex conversation in Ask first, but not in Workspace write or Full access.

DorkOS's own risky actions, like deleting a schedule or removing an agent, still stop for you whatever this is set to. The areas above decide those.

An agent's own Files & commands setting beats everything else for that agent: its conversations, its scheduled runs, and its turns in rooms. Without one, the agent follows the setting for its runtime in Settings → Runtimes, if you set one, and otherwise the setting everyone has.

Presets

A preset sets every area and Files & commands at once. You pick one when you first set up DorkOS, and you can change it any time in Settings → Permissions or in the Control Center (the ⚡ button in the top bar). There are two: Trusted, the default, and Careful, for anyone who would rather approve things by hand.

On Trusted, your agents do routine work on their own and everything they do is recorded, so you can see it afterwards. Safety limits and Reach & secrets still ask, because those two can never be Allowed for anyone. On Careful, agents ask before touching anything in the areas above, the same way DorkOS always used to work.

A fresh install starts on Trusted. Anything you change on top of a preset counts as a change, so the picker reads, for example, "Trusted, 2 changes". Reset to Trusted takes the changes away. Choosing a preset replaces those changes; agents you set differently keep their own settings unless you tick them in the question DorkOS asks.

The request card

When an agent does something set to Ask, or asks for something that is Blocked, a card appears. It shows in the top bar's inbox, at the top of Home, in the conversation the agent is having with you, and, when one of your rooms caused it, inside that room. It says what the agent wants to do, in DorkOS's own words, and has three answers:

• Allow: this one time.
• Always allow: this time, and from now on for this agent and this one action. It becomes that agent's own setting for that action, which you can see and reset on the agent's Permissions page.
• Deny: no.

After a yes, the agent carries on by itself. If it was waiting in the conversation, it continues in the same reply; if nobody was watching (a scheduled run, say), DorkOS tells it your answer and it picks up from there.

Safety limits and reach and secrets never offer Always allow. Their cards show Allow and Deny, and one line: "Always allow isn't offered here. Changing this needs your yes every time."

If you keep saying Allow to the same thing, the card offers to remember it. After you allow the same action for the same agent three times in a week, the next card for it shows Always allow a little more clearly, with one line: "You've allowed this 3 times this week." It stays highlighted until you answer Always allow or tap Not now, which turns it off for that agent and that action. Not now shows in the history, and its Undo turns the suggestion back on. Allow stays the first answer, and the card never offers this where Always allow isn't offered at all.

When an agent asks for something that is Blocked, the card says so and quotes the reason the agent gave. An agent can only ask about one thing per area at a time, cannot ask for the same thing again for a day after you say no, and can ask at most five times an hour. Action Approvals has the details.

Change what everyone may do

1. Open Settings → Permissions.
2. Find the area and pick Blocked, Ask, or Allowed. For Files & commands, pick Ask first, Act, or Full autonomy.

Before you change anything, each row says how many agents it reaches, for example "affects 33 agents": every agent that follows that setting instead of having its own. The preset, each single action, and Files & commands say the same, and the count is the same one the question below and the dorkos command use.

If some agents are set differently, DorkOS asks before it changes anything. Nothing is checked for you: tick the agents you want to follow the new setting, then choose Update selected, or choose Keep their settings to leave them as they are.

A "2 agents differ" link under a row lists who is set differently. Each has its own Reset, which puts that agent back on the setting everyone else has. The Control Center lists every agent set differently too, each with a one-tap Reset.

Why is it set this way?

Next to every state there is a Why? link. Click or tap it to see where the state comes from, for example "Allowed, from the default (Trusted).", and who last changed it, when, and where: "Changed by someone on this computer on Sep 23 from a request card." A locked area says it can never be Allowed. An action that deletes or removes something says it always asks unless you set it on its own. On a phone, the answer opens from the bottom of the screen.

The Control Center's list of agents set differently has the same link on each row, and the "2 agents differ" list shows who set each one and when.

Set one agent differently

1. Open the agent's profile.
2. Choose Permissions.
3. Pick a state for the area, or a position for Files & commands.

A row that says "Same as everyone (Allowed)" follows your default. Once you change it, the row shows a dot and a Reset to default button.

An action you answered Always allow for shows under its area, for example "Except Open a room: Allowed", with its own Reset.

If the agent runs on a program that cannot use DorkOS tools, the page says so: those settings do not change anything for it.

From a terminal

The dorkos command changes the same settings, through the same checks, and the history records them the same way:

dorkos permissions                              # the preset, every area, and who differs
dorkos permissions set --preset careful         # choose a preset: trusted or careful
dorkos permissions set tasks ask                # one area, for everyone
dorkos permissions set tasks_delete blocked     # one action, for everyone
dorkos permissions reset tasks                  # back to the preset
dorkos permissions history --agent dorkbot      # recent changes, each with its id
dorkos permissions undo <id>                    # undo one of them

dorkos agent permissions dorkbot                # what one agent may do, and why
dorkos agent permissions dorkbot set rooms ask  # give it its own setting
dorkos agent permissions dorkbot set files ask  # its own Files & commands
dorkos agent permissions dorkbot reset files    # back to the setting everyone has

Who can change them

You can, from the permission pages, the dorkos permissions command, or your answer on a request card.

On Trusted, your own agents can change permissions too, for themselves or for other agents, and every change lands in the history with the agent's name on it. If you want a setting no agent can undo, set the Permissions area itself to Ask or Blocked: then an agent can only ask you. On Careful, an agent always has to ask.

Two kinds of caller always have to ask, on any preset: a tool or script DorkOS can't place as one of your agents, and an agent whose turn was started by someone outside your team. Safety and Reach settings, and the settings only you may change, like turning on remote access, always need your yes. Those cards never offer Always allow.

What permissions can't stop

An agent's own settings are kept in a file in its folder (.dork/agent.json). Anything that can edit files on your computer can edit that file, and that includes an agent that has file tools. DorkOS can't prevent that, and turning on login doesn't prevent it either, because login guards DorkOS, not your files.

A new agent is different. When DorkOS first adds an agent from a folder, whether you add it, an agent adds it, or DorkOS finds it on its own, the permissions already written in that folder's settings file were never your choice. So DorkOS keeps only the ones that are stricter than your defaults, drops the rest so the agent follows your defaults, and says so in the history. If DorkOS can't write the file back, it still ignores the dropped ones, and the history says it couldn't apply the file. You can give the agent more afterwards, in DorkOS.

For an agent DorkOS already knows, what it does is notice. The next time it checks that agent's permissions, it records the change in the history as "Changed outside DorkOS", with what it was before and what it is now. The change takes effect, because you may have edited the file yourself on purpose. The agent's Permissions page marks the row too, so you can see it and set it back.

If an agent should never be able to do something, don't rely on its settings alone: give it no way to edit files in its own folder, or keep a close eye on the history.

The history

Every change DorkOS makes or notices is recorded, and the history is kept for good rather than for 30 days. So is every answer you give on a request card. Settings → Permissions shows all of them; an agent's Permissions page shows the ones that touched it. Each line says what changed, who changed it, and when.

Undo

Every change in the history has an Undo. It puts things back the way they were before that change, and it is recorded as a change of its own, so you can undo an Undo too. A line you undid says Undone; if you later undo that Undo, the line is in effect again and offers its Undo again. If something is already back the way it was, Undo says so and changes nothing.

• If something changed since, Undo asks before it overwrites it, with the value it would put back: "This has changed since. Set it back to Ask anyway?" Choose Set it back to go ahead, or Cancel to leave it.
• A change that reached several agents at once (a new default, with the agents you chose to bring along) puts back everything that still matches and tells you what it left alone: "Undid 3 changes. 1 had changed since and was left alone."
• Undoing a preset switch puts back the old preset, the changes you had on top of it, and its Files & commands position, together.
• Undo never makes a locked area Allowed, or anything that always asks. If putting something back would do that, Undo leaves it alone and says so.
• The line saying DorkOS didn't apply a new agent's own settings has no Undo. Those settings were never chosen in DorkOS; set any you want on the agent's page.

An answer on a request card has no Undo, because the action already happened. An Always allow answer also records the setting it created, and that line does have an Undo.

With login off, DorkOS cannot tell you apart from any other program running on your computer, so it records a change as made by "Someone on this computer" and says why. With login on, it names your account. Changes made when DorkOS upgraded itself are labelled "Upgrade", and edits to an agent's settings file are labelled "Changed outside DorkOS".

What changed

Agents used to ask first. Now they work on their own, and a record of everything they did is what you check instead of a card in front of every step.

Existing installs move to Trusted once. The first time you open the version with this change, DorkOS moves your permissions to Trusted and shows a one-time note: "Agents now work without asking." Got it dismisses it. Keep asking me puts you on Careful instead and keeps anything you set to Blocked, so your agents keep asking first. Either way, the note shows once and never comes back. A fresh install starts on Trusted directly and shows the same note once, on its second launch.

Choosing Careful before the upgrade is respected. If you had already set the preset to Careful, or answered DorkOS's old setup question with "keep asking me," nothing moves and no note appears: you already answered the question the note asks. Anything you set to Ask or Blocked yourself, on any area, stays exactly as you set it, and so does a Files & commands setting of Ask first.

Careful now covers more areas than it used to. On a Careful install, agents ask before they touch tasks and schedules, other agents, chat connections, or rooms, where some of those used to run without asking.

Agents can message each other across projects. DorkOS turns this on once, the first time it starts after the upgrade (or on a fresh install), on Trusted. A Careful install is left as it was. If you turn it off afterwards in Team → Access, it stays off. See Mesh.

Schedules an agent makes for itself start running. On Trusted, a schedule one of your agents proposes is armed right away and you get a notification with Pause; on Careful, it still waits for your approval the way every schedule used to. A schedule that comes from a file, a package, or a Shape still waits for you either way; that part never changed.

An extension an agent builds for you turns on by itself. On Trusted, a mini app your agent makes with create_extension is approved the moment it is scaffolded, bound to that exact folder and the permissions it asks for today. A copy from anywhere else, or a later version that asks for more, still waits for you. On Careful, every extension waits, same as before.

Your connected apps are shared with every agent. On Trusted, an app you connect starts shared with every agent, including agents you add later, at Read and write, or Read where that is all the app offers. The first time DorkOS starts after the upgrade, it does the same, once, for each app you had connected that no agent could use yet, and the one-time note lists them, each with Choose agents to pick agents one by one instead. If you had already dismissed the note, it shows once more to name them. An app you had already given to some agents stays exactly as it was. Deleting things and the other actions no level covers still need you to allow them one at a time. On Careful, nothing is shared: apps you connect wait for you to choose, and switching to Trusted later shares only the apps you connect after that. See Connections.

Two older settings are gone, and what they said carries over:

• The per-agent limit ("observe", "act"): an agent limited to observe now has every area Blocked. It can still post and react in conversations.
• The Agent context switches for tasks, messages, other agents, and chat connections in Settings: a switch you had turned off becomes that area Blocked for everyone.

An agent you had switched Manage rooms on for keeps rooms; one you had switched it off for has Rooms blocked.

Standing permissions (the old "stop asking about this for 8 hours" answer) are gone; Always allow replaces them. Any that were still running when you upgraded were ended, not made permanent, and the history has a line for each.