Permissions
Control which tools PandaOS may use, with global defaults and per-project overrides.
The trust model
Every tool PandaOS can invoke (running shell commands, editing files, making network requests, interacting with connected apps) is governed by a permission level. This gives you fine-grained control over how much autonomy PandaOS has.
| Level | Behavior |
|---|---|
| Allow | The tool runs immediately without asking. Best for tools you trust completely, like reading files or searching documentation. |
| Ask | PandaOS prompts you for approval each time the tool is invoked. You see exactly what it wants to do and can approve or reject. This is the default for most tools. |
| Block | The tool cannot run at all. Use this to disable capabilities you never want PandaOS to use in a given context. |
Global vs. project overrides
Global defaults apply to every project unless overridden. Project overrides tighten or relax a specific tool for one project only and always win over the global default.
This two-tier system lets you set sensible defaults (for example, "always ask before running shell commands") while making exceptions where appropriate (for example, allowing npm run test without approval in a trusted project). The settings panel marks where a project differs from the global default so customizations stay visible.
Dangerous tools
Tools that can delete files, run arbitrary shell commands, or make network requests are flagged as dangerous and default to Ask. Raising one of these to Allow removes the approval prompt, so use elevated permissions carefully.
Usage
What you spent and where: tokens, cost, cache hit rate, broken down by day, model, project and session.
Execution Environment (Sandbox)
Contain what the AI harness can touch on your machine: filesystem, connected apps, and network, with the same guardrails no matter which model or harness you run.