Safety & Permissions
The Safety & Permissions feature is Zide Assist’s safety layer. It controls which tools Zide Assist has, how far its file tools can reach, and which actions ask for your approval before they run.
It uses a scale of five presets over two underlying controls: Tool access and Approvals. The preset is always derived from those two values, so the two views can never disagree. If you set them by hand to a combination that matches no preset, the scale shows Custom.
To change your default posture, open Settings > Zide Assist > Safety & Permissions. To change the posture for the session you are in, use the shield icon in the Zide Assist toolbar (see The shield dropdown below). Both surfaces show the same five presets and two controls.
The five presets
| Preset | Tool access | Approvals | What it means |
|---|---|---|---|
| Lockdown | Locked | Everything | No shell, no web access, no remote git, no provider tools (issues, PRs, CI, releases), no MCP tools. Every change asks first. The most restrictive setting. |
| Guarded (default) | Project | Everything | All tools available inside this folder. Every change asks first, including every shell command. |
| Assisted | Project | Local edits auto | Edits files and runs local git on its own. Asks before shell commands and anything others can see. |
| Autonomous | Project | Shell only | Handles files, git, and your git host on its own. Asks before shell commands and destructive operations. |
| Danger Zone | Unlimited | Nothing | Never asks. Runs any command and changes anything, anywhere on this computer, with no folder boundary. |
Each step down the scale relaxes one thing:
- From Lockdown to Guarded, the missing tools come back (shell, web, remote git, provider tools for issues, PRs, CI, and releases, MCP). Everything still asks.
- From Guarded to Assisted, local file edits and local git stop asking. The undo story is git itself.
- From Assisted to Autonomous, actions others can see stop asking: pushes, pull request and issue changes, releases.
- From Autonomous to Danger Zone, shell stops asking, the folder boundary drops, and the destructive-operation confirmations drop.
There is no read-only preset. That is Plan mode, a workflow toggle that unbinds mutation tools; it works with any Safety & Permissions setting.
The two controls
The presets set two controls, Tool access and Approvals, which you can also set directly under Advanced: Manual Controls in the Safety & Permissions section. Setting them by hand can weaken Zide Assist’s protections, so while a preset is selected, opening Advanced shows a short notice and a button to reveal the controls. Once your combination no longer matches a preset (a Custom posture), the controls show directly.
Tool access
Tool access controls which tools exist and how far Zide’s own file tools can reach. Zide Assist does not provide an operating-system sandbox, and shell command output is never confined to the project folder.
| Level | Meaning |
|---|---|
| Locked | No shell, no web fetch or search, no remote git, no provider tools (issues, pull requests, CI, releases), and no MCP tools at all. File tools stay inside the project folder. |
| Project | All tools available. File tools stay inside the project folder. Shell commands follow the Approvals setting. |
| Unlimited | All tools, and file tools can reach the entire filesystem. |
Approvals
Approvals controls which actions need your confirmation before Zide Assist acts. Reads never ask; the ladder is about mutations.
| Level | Still asks | Runs without asking |
|---|---|---|
| Everything | All changes: file edits, git, shell commands, pushes and PRs, MCP tools | Reads only |
| Local edits auto | Shell commands, pushes and PRs, MCP tools, destructive operations | File edits, local git, opening links |
| Shell only | Shell commands, MCP tools, destructive operations | File edits, local git, pushes and PRs, opening links |
| Nothing | Nothing | Everything |
“Pushes and PRs” here means anything other people can see: git pushes, remote branch and tag deletion, and issue, pull request, release, and comment changes on your git host.
The table describes what each Approvals level gates when the tool exists. At Tool access Locked, shell, web, remote git, provider tools (issues, pull requests, CI, releases), and MCP tools do not exist at all, so only the remaining actions (file edits, local git, opening links) are governed by the Approvals level.
What always asks
At every Approvals level except Nothing:
- Every shell command asks first, unless you granted shell for the session (see below). Zide Assist never pattern-matches commands to guess which are dangerous; below Danger Zone, a person sees each one.
- Destructive operations confirm individually, even when their category runs automatically or was granted for the session. This covers hard resets, discarding uncommitted work, force checkouts, branch and tag deletion, recursive deletes, and similar unrecoverable operations.
- Execution-adjacent changes confirm individually: git configuration keys that can lead to code execution (such as hooks paths and aliases), and file writes under
.git/or.zide/.
When an approval prompt appears, you can approve once or, for ordinary categories, check “don’t ask again this session” to grant the category for the rest of the session. The shield dropdown lists active session grants and lets you revoke them. Destructive and execution-adjacent confirmations never offer the session grant.
The shield dropdown
The shield icon in the Zide Assist toolbar opens the security control for the session you are working in. It shows the live posture, and you can change it from here without going to Settings:
- The scale. The same five presets. Selecting one sets both controls for this session. Selecting Danger Zone opens the same acknowledgment dialog Settings uses.
- Advanced. The two controls, Tool access and Approvals, as individual selects. A combination that matches no preset shows the scale at Custom.
- Summary. When your posture matches a preset, the summary is that preset’s description; a Custom posture lists what asks, what runs freely, and how far file tools can reach.
- Session grants. The per-category “don’t ask again this session” grants, with a button to revoke each one. Revoking applies immediately, so the section says so.
Everything here is session-scoped: it changes this session only and never rewrites your defaults. When the session posture differs from your defaults, the dropdown header shows a Session override marker and offers a single Reset to default action that clears both overrides at once. To change your defaults, use the gear in the dropdown to open Settings.
You can also set the posture before you send your first message — open the shield on a fresh Zide Assist tab and pick a preset or dials. The choice is held for that session (marked Set for this session) and takes effect when the agent starts, so you are never forced to begin under settings you do not want. It does not change your saved defaults.
Tool access and Approvals always take effect on the agent’s next turn, never in the middle of one. A turn that is already running finishes under the posture it started with, so its tools and approvals stay consistent from start to finish; your change applies when the next turn begins. This is true however you change them: picking a preset on the scale and setting the two controls by hand under Advanced are the same change, because a preset is just a named pair of those two controls. While a change is waiting, the dropdown says so, directly beneath the controls it applies to. On that first turn after a change, Zide Assist is told in one line what changed.
Revoking a session grant is the exception: it applies immediately. Grants are checked afresh at every tool call rather than being fixed at the start of the turn, so revoking one takes hold at once, even inside a turn that is already running: the next tool call in that category asks for approval again instead of running. This is why the Session grants section carries its own note and is kept below the line that describes the next-turn behavior of Tool access and Approvals.
Danger Zone
Danger Zone never asks for approval. Zide Assist can run any command and change or delete anything this machine can reach. Selecting it, from any surface, opens an acknowledgment dialog; nothing changes until you check the acknowledgment box and confirm. The acknowledgment is recorded with a timestamp and app version.
While Danger Zone is active:
- The shield icon shows a struck-through shield.
- Each new session opens with a message stating the posture.
One protection still applies even in Danger Zone: Zide Assist can never reach cloud credential endpoints, and no setting turns that block off. Danger Zone removes prompts and the folder boundary, not this.
If you use Danger Zone, use a machine and accounts that cannot reach anything you would mind losing.
Notes
- Safety & Permissions governs Zide Assist only. The CLI Agent tab has its own unrestricted-profile safeguards.
- The session log is a separate privacy setting and is not part of the Safety & Permissions scale.
- Tool access and Approvals apply on the agent’s next turn, from either Settings or the shield dropdown; a turn that is already running finishes under the posture it started with. Revoking a session grant is the exception and applies immediately, even mid-turn. A new session always starts from your current defaults.