Permissions and security

How ADE keeps agent work scoped, reviewable, and local-first.

ADE agents can edit files and run commands, so permissions matter. The goal is to keep work scoped to the right lane and make risky actions visible before they happen.

Main controls

Lane scope

Sessions run inside a selected lane worktree.

Provider permissions

Claude, Codex, Cursor, and OpenCode each expose provider-specific approval modes.

Command trust

Shared command definitions may require local approval before they run.

Secrets

Credentials stay in local encrypted stores or gitignored files.

Practical defaults

• Use worktree lanes for agent edits.
• Keep the primary checkout for inspection or manual commands.
• Review diffs before committing or pushing.
• Use stricter provider approval modes for unfamiliar repositories.
• Do not store provider keys in committed files.
• Treat shared command changes like CI or Dockerfile changes: review them carefully.

Provider modes

Permission names vary by provider. In general:

Mode style	Meaning
Read-only / plan	The agent can inspect and propose, but cannot freely edit.
Default / edit	The agent can work in the lane with normal guardrails.
Full access	The agent can run with fewer prompts. Use only when the environment is trusted.

Sensitive actions

Be extra careful with:

• Force pushes.
• Commands outside the repository.
• Secret files and .env files.
• Scripts pulled from unreviewed branches.
• Networked deployment or release commands.

ADE helps enforce boundaries, but it is still running tools on your machine. Review what agents ask to do, especially in new repositories.