Connectors

Connecting most integrations requires the relevant connect* entitlement, enforced the same way every other entitlement is — checked server-side, not just hidden in the UI. See Connector Overview for the architecture.

How it works

What you see

• Permission questions, connection approval screens, blocked-action messages, workspace boundaries and system-change warnings.
• When something is blocked, you see why.

What PawOS does

• Security-sensitive actions are carried out by protected parts of the app that the interface cannot bypass.
• Commands follow strict rules that prevent injected or chained commands.
• Credentials stay in each connection’s secure storage — you never paste them into chat.

Permissions

• No plan approval, companion setting or urgency can skip a permission question.
• Changes to files, commands, git, installs, system settings, deployments and connected services always need approval.

Records

• Security-sensitive actions record the request, the approval, the result, and why anything was blocked.

Good to know

• Review plans, diffs, commands and deployments before approving them.
• Your operating system and connected services have their own permission prompts and policies.