Permissions and security

Permission modes

Confirm writes

The default. Reads are allowed; operations that change something ask for approval.

Confirm all

Every tool asks for approval, reads included.

Auto-verify

Low-risk work is processed; other requests in headless runs and chat are verified by the permission reviewer.

Allow all

Everything outside the hard blocks is allowed. Access outside the allowed folders still needs its own approval.

Tool calls fall into read, write, shell, network and meta. Risk is low, medium or high.

How a request is decided

• Hard-deny rules always run first: sensitive paths, invalid manifests and sandbox limits.
• The reviewer is one of Validation off (auto-pass), Rule-based validation, LLM validation, or Strict (all pending). LLM validation can raise a risk rating, never lower it.
• If the reviewer fails, the request is held, not passed.
• In headless runs, anything above low risk goes to a deferred queue.

Approving

Requests appear in a dock at the bottom of the window that does not cover the conversation. The buttons are Reject, Allow once and Always allow. Always allow is bound to the exact tool, input and working folder; if the target name contains a wildcard, Ave won’t save the rule and suggests Allow once instead.

A conversation a plugin proposes (an overlay suggestion) starts only when you accept it, and write, shell and network tools inside it ask again.

Allowed folders and sensitive paths

Allowed folders start with the project root, ~/.ave and a private scratch folder, and grow through permissions.additionalDirectories in settings. Anything outside them asks separately.

Sensitive paths, such as keys under ~/.ssh and .env files, are blocked in every mode.

Users and administrators can each keep a policy.json. A valid administrator policy locks the settings it covers.

The OS sandbox

An opt-in feature that confines tool execution at the operating-system level. It is off by default, and turning it on needs a restart.

macOS

Seatbelt. Confines files, processes and network.

Linux

bwrap. Confines files, processes and network.

Windows

srt-win. Confines files and network, not processes.

With the sandbox on, network is denied by default. Isolation between plugins is available on macOS and Linux only.

Audit log and masking

~/.ave/audit.log is HMAC-chained, so a change in the middle shows. Audit records never contain raw secrets. Secrets and personal data are masked before anything goes to the model, and each mask is recorded in the audit log.