> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ospribrain.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions and Safety

> Understand exact command grants, device and project scope, provider data, and protected files.

## Operating-system permission

macOS controls Accessibility and Screen Recording. OSPRI opens normal macOS prompts and waits for the user. Windows reports computer-use readiness through its native helper contract instead of showing those macOS prompts.

## OSPRI approval choices

| Choice                 | Effect                                                       |
| ---------------------- | ------------------------------------------------------------ |
| **Allow once**         | Approves this action only                                    |
| **Allow this session** | Allows matching use for the current app session              |
| **Always allow**       | Creates a remembered grant where that action type permits it |
| **Deny**               | Blocks the action                                            |

Exact terminal command grants include the exact command and exact working directory. Generic terminal grants are device-scoped and may use a wildcard project scope. Selected local-coding actions can add a specific coding-project scope.

Package installs, compound commands, and high-risk actions cannot create broad remembered grants.

<Warning>
  Catastrophic commands remain blocked even when an agent asks for them or a prior approval exists.
</Warning>

## Review and revoke grants

Open **Agents & models** to review remembered approvals and revoke access you no longer want. A timed-out approval is treated as unanswered and the blocked action does not proceed.

## What a hosted provider can receive

For a direct hosted model, the provider can receive:

* Your prompt
* Tool results returned to the model
* Attachment content selected for the turn
* Authorized attachment metadata, including its filename, MIME type, size, and absolute local path in the executor prompt

Cloud queue serialization strips local path authority fields before transmission, but that does not apply to every direct-provider turn. Do not attach a sensitive file unless the selected provider may receive it.

## Protected data

OSPRI blocks known credential files, secret stores, unsafe system roots, and symbolic-link escapes from ordinary file access. A broad research request does not silently override those rules.

## Execution lanes

| Lane                                | Where tools run             | Model or service behavior                                                                 |
| ----------------------------------- | --------------------------- | ----------------------------------------------------------------------------------------- |
| **This Mac** with a direct provider | Shell and files run locally | Prompt, tool results, and selected attachment data go to the configured provider          |
| **Ollama** when configured          | Model and tools are local   | Current Ollama lane is text-only for attachments                                          |
| **OSPRI Cloud**                     | Cloud workflow              | Cloud receives the workflow input and strips local path authority from queued attachments |
| **Deep Research**                   | Cloud research workflow     | Uses cloud research services and project-aware context                                    |

Always check the composer and Connections before using sensitive material.