Staying safe with agent permissions

Why agents ask

Each conversation has a permission mode, chosen with the agent button at the bottom of the message box. It decides what the agent may do on its own. When the agent needs to do something its mode doesn’t allow, it stops, and Enjoy shows a card in the conversation with choices such as Allow once and Decline. Read what it wants to do before you allow it. See Approve or decline agent requests.

Each agent has its own modes, and the default depends on the agent. Some modes only explore and plan, such as Plan or Codex’s Read-only. Others let the agent work in your project and ask before anything more. See Choose what your agent can do without asking.

What broad modes risk

These modes let an agent act without asking:

• Bypass permissions in Claude Code and Antigravity. Antigravity uses it by default.
• Full access in Codex, which can “Run commands and edit files anywhere, with network access and no approval prompts.”
• Always approve in Grok Build.
• Unrestricted in Muse Code, which has “No sandbox or approval prompts, with direct network access.”

With these, nothing stops a mistake before it happens. An agent can overwrite or delete files and run any command. Web pages, files, and downloaded code it reads can also contain instructions written to trick it. Enjoy’s descriptions of Bypass permissions say to use it only in an environment you trust, and the same caution applies to the others.

Antigravity’s other mode, Configured permissions, follows its own settings. Enjoy can’t show its approval prompts, so actions that would need approval are skipped.

Protections Enjoy adds

• You choose Full access or Limited for each personal device on the computer it connects to. Full devices can answer agent approvals; Limited devices and team members leave those decisions on the computer.
• Full browsers and connected computers can change agent permission modes. Limited devices and team members cannot broaden them. The native iPhone app still has no permission-mode picker.
• Adding devices and changing their access levels always happens on the computer that runs the projects. See Manage your devices.
• A conversation that an agent starts can’t have broader permissions than the conversation that started it.
• When a message comes from another device, Enjoy tells the agent and asks it to take more care with risky requests.

Safer habits

• Start big or unclear tasks in a planning mode, and read the plan before you let the agent change anything.
• Commit often, so any change can be reviewed and undone. See Undo changes an agent made.
• Try risky ideas in a worktree, a separate copy of your project. See Try ideas side by side in worktrees.
• Keep passwords and keys out of messages. See Keep passwords and API keys safe.