Permissions
Two questions decide what happens when an agent works: who is using it, and what is the agent allowed to do on its own. OtoDock answers the first with roles and the second with permission modes — and pauses for your approval whenever something needs a human in the loop.
Roles: who can do what
Access is granted per agent. Each person assigned to an agent gets one of four roles:
| Role | Can do |
|---|---|
| Viewer | Chat with the agent, work in their own private space, and read the agent's shared files. |
| Contributor | Everything a viewer can, plus add and edit files in the agent's shared workspace. It's the role for an outside collaborator on a project, so a contributor never acts as the agent: no shared tasks, triggers, delegation, shared apps or shared memory. |
| Editor | Everything a contributor can, plus act as the agent: shared tasks and triggers, delegation, shared apps, shared memory. |
| Manager | Full control — shape the agent's persona, knowledge, tools, and settings. |
The dividing lines are deliberate: contributors add files, editors also act as the agent, and only managers change the agent's behavior. These per-agent roles sit under your platform role (admin, creator, or member), which governs the install as a whole.
Phone calls and connecting to SSH hosts don't work in a viewer's or contributor's chat, or in a task one of them created. Shared tasks and triggers can use both.
On a Shared only agent every chat runs as the agent itself, so only editors and managers can chat there. Viewers and contributors can read the chats, but they can't write in them. To let them chat, give them the editor role or switch the agent to a mode with personal chats.
→ See Users & Access for the full picture, including SSO and login security.
Permission modes: how much an agent does on its own
Every chat runs in a permission mode you choose from the dashboard. It decides which actions go through automatically and which pause to ask you first:
| Mode | Behavior |
|---|---|
| Default | The agent reads and explores freely, but pauses for approval before editing files, running anything beyond simple commands, or using a tool. |
| Accept edits | File edits and routine commands go through automatically, and riskier actions still ask. |
| Don't ask | The agent runs autonomously without pausing. |
| Plan (Claude Code only) | Read-only. The agent investigates and proposes a plan, changing nothing until you approve it. |
You can switch modes mid-conversation. When the agent hits something that needs approval, it pauses and you click Allow or Deny right in the chat. Codex chats ask exactly like Claude Code chats do: before every command and file edit the mode doesn't allow on its own.
Plan mode is specific to Claude Code — it engages Claude Code's own built-in plan mode, so it isn't offered for Codex or the direct engine.
Scheduled tasks and phone calls run autonomously by design — there's no one watching a chat to approve each step. Their access is bounded by the agent's sandbox and role, not by live prompts. The few tools that always need a person's approval are refused in them (see devices below).
Command safety
When an agent runs shell commands, OtoDock classifies each one and applies sensible guardrails on top of the mode:
- Routine commands (listing files, reading, searching) go through smoothly.
- Destructive commands (deleting files, wiping data) pause for approval even in "accept edits" mode — so a mistake can't slip through. In don't ask mode you've chosen full autonomy, and they run without pausing.
- Truly dangerous commands (wiping a disk, a fork bomb, reading system password files) are always blocked, in every mode and for every role. There's no way to approve them.
- Host-level commands (managing system services, the container runtime, package installs) are reserved for administrators on the server.
Whatever a command does, it's still confined to the agent's sandbox — so even a command that runs can only touch what the agent was already allowed to touch.
Approving access to your devices
When you run an agent on one of your own remote machines, some capabilities go beyond reading and writing files — controlling the mouse and keyboard, driving a browser with your saved logins (optionally the very browser you're signed into), or operating a desktop app. These are off by default and each one requires you to explicitly turn it on for that machine, with a clear confirmation of what it allows. You can revoke them any time.
Next steps
- Credentials → — how secrets stay out of an agent's reach.
- Users & Access → — roles, SSO, and login security.
- Remote Machines → — access levels and device consent.