Permissions and approvals

Before starting, define what a task may access, what it may do, and which actions need another confirmation. Preferences, project rules, and plugin installation are not substitutes for authorization.

Define task boundaries

For example: “Read only this project folder and list the issues. Do not change files or send anything externally.”

Check project folders, plugin accounts, and conversation approval settings separately. Read access does not automatically permit modification.

Actual approvals and rule previews

The “What AI can do” settings panel lets you inspect and edit tool, path, and workspace rules and simulate policy decisions.

Rule management is currently a preview and does not govern actual tool-call approvals. An allow rule, trusted workspace, or successful simulation is not authorization for automatic execution.

During a task, check the conversation's approval mode, actual confirmation requests, and execution results.

Review a confirmation request

1. Inspect the proposed action and target.
2. Check that it belongs to the task, including account, folder, and remote resource.
3. For sending, deleting, publishing, or spending, inspect content, scope, and recoverability.
4. Approve or decline as appropriate; do not expand scope merely because an assistant says it is necessary.

When access is insufficient, narrow the task to a draft, read-only verification, or already authorized files.

Organization policies

Managed environments may restrict capabilities. Personal preferences do not override organization restrictions, and resetting personal rules does not remove managed policies.

Before sharing a diagnostic export, inspect it for sensitive paths, content, or identifiers.

Start with a verifiable task

Ask EvoX to list task-related files in a specified directory without changing them. Once the scope is correct, request edits with clear confirmation points.

See Permissions for task examples and Network troubleshooting for connection failures.