Permissions, explained simply

Kaivo works in the folder where you started it. Reading files in that folder needs no approval. But changing a file, creating one or running a command in your terminal does: a window shows you the action and offers three choices.

Allow: this action is allowed, once. Allow for the session: the same action (same tool, same folder) won't be asked again until the end of the session. Deny: nothing happens and Kaivo is told.

A few simple habits. Start Kaivo in your project folder, never at the root of your disk. Keep your project under version control (Git) so you can go back. And don't allow an action you don't understand: ask Kaivo to explain it instead.

Kaivo can't promise it will never get things wrong: it's a model, it can misunderstand. Permissions are there so that you decide.

There's an opposite mode: /bypass. In this mode, no human approves anything: Kaivo changes files and runs commands without asking. A red BYPASS badge stays in the bottom bar. Keep it for a project under Git, in the right folder, for a task whose scope you know. /bypass off to go back to normal mode. /permissions tells you which mode you're in at any time.