Guardrails and privacy
Modes
Set the default under Hosts → Agent access → Default for all hosts, and change individual hosts in the Registered hosts list above it.
| Mode | Agents can |
|---|---|
unrestricted |
do anything you could do in the session. This is the default. |
guarded |
do most things, but destructive commands and file deletions need your approval, and commands on the deny list are refused. |
read-only |
read screens, output and files, and nothing else. |
Modes can only be changed in the viewer. Agents can see which mode a host is in, but can’t change it.
Approving requests
On a guarded host, when an agent tries something that needs approval, the viewer shows you exactly what it wants to run with Approve and Deny buttons. If nobody answers within two minutes, it’s denied.
This applies to commands typed one key at a time through send_input as well as ones sent with run_command.
Each decision is written to the session’s audit log.
Private sessions
A private session is invisible to agents. They can’t list it, read it or type into it. You can make a session private when you open it or at any time afterwards, and it’s recorded as usual.
A reasonable setup
Set the default to guarded, then loosen it for test machines you’re happy to let an agent drive. Use read-only on production hosts where you want the agent to diagnose but not fix. Use private sessions for anything with credentials or data an agent shouldn’t see.
Next: Passwords and host keys