Permissions and safety
Always Ask, Auto and Bypass Permissions, the guard, and what no agent ever does.
Agents in Vixentio act only within limits people set. Every action an agent wants to take, editing a file, running a command, pushing a branch, is checked by Vixentio's own guard before it happens, on a Mac or in a cloud workspace. The agent's own "skip permissions" switch is never used.
Permission modes
A mode decides what an agent may do without asking. It never widens what's allowed at all.
| Mode | What runs without asking | What asks |
|---|---|---|
| Always Ask | Nothing | Every edit and every command |
| Auto | Edits inside the project and the project's own safe commands | Anything else |
| Bypass Permissions | Everything that's allowed | Nothing; what isn't allowed is still refused |
Set a default for each project in its settings or in Settings › Agents & Permissions. You can pick a mode for a single request, and a task keeps the mode it started with. Changing a running task's mode applies from its next decision; loosening the mode of team work needs approval rights, while tightening never waits.
Never allowed, in any mode
These are refused in every mode, Bypass Permissions included. Vixentio reads the command itself, so a different spelling of the same thing is refused too.
- Any git or GitHub write from the shell: commits, pushes, branch switches, pull requests. Those happen only in the Publish step (see Reviews and Publish).
- Recursive or wildcard deletes, such as
rm -rf. - Dropping or resetting a database.
sudoand changes to the system.- Piping something downloaded into a shell.
- Publishing or deploying.
- Writing outside the project, or inside
.git.
And even in the Publish step, Vixentio never force-pushes, rewrites history, deletes a remote branch, runs git reset --hard, or changes git configuration or credentials.
Git writes by mode
| Action | Always Ask | Auto | Bypass Permissions |
|---|---|---|---|
| Commit, push the task's branch, open a pull request, revert | Asks | Runs | Runs |
| Merge, push to the default branch | Asks | Asks | Runs, only with passing checks |
| A file with your own uncommitted changes | Asks | Asks | Left out |
Secrets stay out
- Agents can't read secret files:
.envfiles, private keys, SSH, cloud and GitHub credentials. This holds in every mode. - Everything that leaves your Mac or a cloud workspace, from a brief to a guidance message, is scanned for keys and tokens first. A brief that looks like it contains a secret asks before it's sent, even in Bypass Permissions.
- In a cloud workspace, your project's secrets go only to the dev server and the checks Vixentio runs, never into the agent's environment (see Cloud workspaces).
Your own work is never overwritten
Vixentio tells your edits apart from the agent's before every write. If you change a file while an agent works, the agent's change never replaces yours, and Undo removes only Vixentio's own change, line by line. Undo never uses git reset, checkout, restore or stash, so nobody else's work moves.
Who may start runs on someone else's Mac
A Mac runs a teammate's request only if its owner turned on Share This Mac as a Host, and only in a permission mode the owner accepts from others. The owner accepts each request, or sets a rule for who may start without asking. Bypass Permissions from others is off unless the owner turns it on. See Where agents run.
Corrections are bounded
When a project's checks fail after an agent's change, the agent may try to fix it at most three times on its own before a person decides what's next.