Permissions

Every agent has its own permissions: whether it may read files, write files, use a terminal or the network, and whether it has to wait for your approval before each task. This page explains where you set them, what each one does, and how far each provider actually enforces them.

Where to set permissions

You can edit the same permissions in two places. They stay in sync and are saved instantly.

• Settings → Permission Matrix: a grid of all agents and their permissions, with a Paths column for extra folders and a How is it applied? note. Open Settings with Ctrl+,.
• Organization → Agents → an agent → Permissions: the same switches for one agent, plus Extra allowed folders.

The permissions

Permission	What it allows
Read files	Read and search files in the workspace (the project folder).
Write files	Create and edit files.
Terminal	Run shell commands with your user’s rights.
Network	Fetch web pages and search the internet.
Browser	Not applied yet: agents can’t use the in-app browser.
Require approval	Wait for your approval before starting each task.
Extra allowed folders	Folders the agent may access in addition to the project folder.

Agents always start in the folder of the task’s project. Agents that run on a CLI provider (Claude Code or Codex) need a project folder; without one they won’t run. See Projects.

Permission templates

When you create an agent, you pick a Permission template. You can change individual permissions afterwards.

Template	Description
Read-only	Reviews and reports; doesn’t touch files.
Developer	Reads and writes files; terminal and network off.
Full access	Files, terminal, network and browser enabled.

Agents created from a team template start with Require approval turned on (except the lead of the Core Team template, which doesn’t take tasks), so expect approval cards in the left panel on their first runs. See Organization.

How each provider enforces permissions

Agents see their permissions in their instructions, but that is not what enforces them. The enforcement comes from how Agentbits starts the provider.

Permission	Claude Code CLI	Codex CLI	Anthropic / OpenAI API
Read files	File reading and search tools are enabled, limited to the working folders.	Codex always reads; without this permission a Codex agent won’t run at all.	No file system access.
Write files	Edit tools are enabled. Edits are auto-approved only inside the project folder and extra folders; anything outside is refused.	Runs in Codex’s workspace-write sandbox: writes only inside the project folder. Without it, the sandbox is read-only.	No file system access.
Terminal	The shell tool is enabled. While on, file and network limits can be bypassed through the shell.	Codex always runs commands in its own sandbox.	No terminal.
Network	Web fetch and web search are enabled.	Network access inside the sandbox (when Write files is also on). The unrestricted “full access” mode is never used.	No web access.
Extra allowed folders	Added as extra working folders.	Not supported.	Not applicable.
Browser	Not enforced.	Not enforced.	Not enforced.
Require approval	Enforced.	Enforced.	Enforced.

A few more things apply:

• Claude Code runs without the repository’s own .claude settings and hooks, and ignores the project’s .mcp.json, so a repository can’t change an agent’s permissions or add its own servers. Tool calls the permissions refuse show up as warnings in the agent’s terminal.
• Anthropic and OpenAI API agents can’t edit files or run commands at all. They work with text and Agentbits’ own tools (connections, file attachments, skills, apps), each controlled by its own grants. To change code in the project folder, use a CLI provider. See Providers.
• Demo simulates work and doesn’t touch your files.
• Chat replies and lead reviews never get file-editing or terminal tools.
• File, terminal and network changes apply from the agent’s next run. Connection and app changes apply from its next tool call.

Warning: An agent with the Terminal permission on Claude Code can do anything your user account can do. There is no operating-system-level isolation. Give it only to agents you trust, or run Agentbits under a restricted OS user. With Terminal and Network together, an agent can also reach servers directly using credentials stored on your computer.

Require approval

When Require approval is on, each task the agent picks up waits in the left panel under Running work with an approval card that shows the permissions it asks for. Approve it to start the run, or reject it. This works for every provider; for the API providers, no model request is made before you approve.

This is separate from the approvals that individual actions can trigger:

• write and admin operations on Production connections (Connections),
• app tools set to Ask me first (Apps).

Other grants

The permission matrix covers files, terminal and network. Other access is granted separately, and all of it is off by default:

What	Where you grant it
Servers and databases	Settings → Permission Matrix → Connection permissions, or the connection’s Agent access tab. See Connections.
Apps (MCP)	The app’s Access tab, or the agent’s Apps section. See Apps.
Skills	Assignment to the agent or one of its units. See Skills.
File attachments	Sharing when you attach a file, or the file’s Access tab. See Files.

For the overall model and its limits, see Security.