Execution policy

Control what the agent is allowed to do on your machine under Settings → System → Security.

Windows users: sandbox_mode states file-access intent; whether the OS enforces isolation is governed by the Windows sandbox (v0.7.4+). Configure both.

Sandbox mode (`sandbox_mode`)

Mode	Effect
Workspace write	Read/write inside workspace root (default) — `workspace-write`
Read only	No file writes — `read-only`
Full access	Broader write scope — `danger-full-access` (use sparingly)

Maps to sandbox_mode in config.toml. The desktop Settings → System dropdown may show “Full access” (internal value full-access); after save, treat danger-full-access in config as authoritative.

Under Windows elevated sandbox, even with workspace-write, writes outside the workspace are blocked by the OS.

Feature toggles

Setting	Controls
Shell tool	`exec_shell` family
Web search	`web_search` / `fetch_url` / `web.run`
Exec policy	Runtime enforcement of sandbox + tool policy
Sub-agents	`agent_spawn` and related tools

Approval policy

Separate dropdown: on-request, untrusted, never, auto. See Tool approval for dialog behavior.

Sandbox backends

Backend	Platform	Notes
Windows native (default)	Windows 10/11	Elevated / Unelevated — see Windows sandbox
macOS Seatbelt	macOS	`sandbox-exec` process isolation
Linux (degraded)	Linux	Policy declared; OS enforcement pending Landlock path
OpenSandbox	Optional	`sandbox_backend = "opensandbox"` — shell in external container over HTTP

Tips

Daily coding: elevated sandbox + workspace-write + on-request approval.
Air-gapped: disable web search and shell.
Office sessions ignore shell regardless of toggle.