Permissions and execution

Separate authorization, access scope, and execution isolation; bound external effects.

Authorization and approvals: Approval decides whether an action proceeds. Check the action, target, account, and effects before accepting it. Installing a plugin, trusting a workspace, or enabling a skill does not authorize its operations.
File and command access: Inspect file access and command effects separately. Naming a project directory does not authorize access to the home directory, other projects, or every record in a connected account.
Sandboxing and isolation: A sandbox limits the files, network, and system resources available to a process. Approval decides whether an action is allowed; isolation determines its execution environment. Inspect both.
Automation and external actions: Give continuous work its own objective, authorization scope, budget, and stop conditions. Starting a background process does not authorize arbitrary remote writes, publication, or spending.

Separate authorization, access scope, and execution isolation; bound external effects.

Authorization and approvals: Approval decides whether an action proceeds. Check the action, target, account, and effects before accepting it. Installing a plugin, trusting a workspace, or enabling a skill does not authorize its operations.
File and command access: Inspect file access and command effects separately. Naming a project directory does not authorize access to the home directory, other projects, or every record in a connected account.
Sandboxing and isolation: A sandbox limits the files, network, and system resources available to a process. Approval decides whether an action is allowed; isolation determines its execution environment. Inspect both.
Automation and external actions: Give continuous work its own objective, authorization scope, budget, and stop conditions. Starting a background process does not authorize arbitrary remote writes, publication, or spending.