Permissions

Any action classified as destructive — writing a file, running a command, installing software, modifying PATH, deploying — requires an explicit confirmation before it runs, enforced by the execution engine itself, not just hinted at in a prompt.

A request missing confirmation is refused with reason requires-confirmation before the underlying action ever executes. See Security & Permissions for the full model, including how this differs for Autonomous Work.

How it works

What you see

• Workspaces, tasks, plans, permission questions, Work Records, usage meters and connection status.
• You use these through normal requests — there is no separate configuration console.

What PawOS does

• A workspace scopes file and command work; a task groups one request; a plan proposes work; an action performs one concrete step; a Work Record captures what happened.
• Work Records are built from the real results of each action, not written up afterwards.

Permissions

• Naming something a workspace, plan or task never skips a permission question.
• PawOS decides what to do, but every change to your machine goes through a dedicated, checked action.
• Plan limits and permission questions are separate protections and can both apply.

Records

• Each claim in a Work Record points to the command, file, check, screenshot or result behind it.
• A Work Record shows partial success, skipped checks, rejected plans and failures just as clearly as successes.

Good to know

• Work Records always show the timeline of what ran; many action types add detailed evidence on top.