What it asks before doing

Every one of the 175 tools carries a posture, and every call is judged against it before it runs. This page is generated from the configuration itself rather than described, because a description of it kept being wrong.

These are the shipped defaults. What you can change lives in a config file you own once TESSERACT is installed, so your copy may differ, and should, once you tune it.

What stops and asks

These 47 tools prompt every time they are used:

Tool
agent_create
agent_promote
api_request
bash
breaker_reset
browser_fill_form
browser_key
browser_select
clock_set_zone
command_run
context_set
credential_setup
delegate_auditor
delegate_coder
email_reply_message
email_send_message
file_copy
file_delete
file_move
file_write
folder_access
git (except branch, diff, log, show, status on the open project)
image_generate
os_launch
pipeline_run_stage
project_budget
project_focus
project_forget
project_link
project_new
project_propose
project_root_relocate
project_set_state
retention_set_window
schedule_create
schedule_remove
schedule_run
schedule_update
screen_look
session_continue
skill_create
skill_refine
task_close
task_propose
task_settle
workspace_decide
workspace_hold

What runs without asking

The remaining 128 run automatically. Most are reads — searching memory, listing a directory, looking something up. Some are not, and those are the ones worth knowing about: sending on a channel you connected, searching the web, writing to the assistant’s own memory. Setting those up was the decision; being asked again each time would be noise.

Two things that surprise people

Read-only commands do not prompt, where they read. 10 command patterns, running the tests and asking git what changed, are allowed in every mode. A prompt for git status is noise, and noise is what teaches people to click through prompts without reading them. The command being a read is not the whole answer though, because a read still reads whatever it is pointed at: the folder it is given to run in, and any argument naming a place of its own, are held to the same limits as a file the assistant opens. Pointed outside those, it asks you like anything else.

There is more than one mode. The shipped default is max, and there are 2 in total. The other is free, for unattended work: the assistant acts without asking, apart from a short list of tools named as still asking. It is not the default and turning it on is a deliberate act. It cannot reach a tool set to deny or the path rules below. It reaches one thing in the shell check list: the one-liner check, which asks in the default mode and runs unasked here, because a prompt nobody is there to answer is a refusal on a timer. The rest of that list is refused outright in this mode rather than asked, for the same reason.

Paths beat tools

A tool’s posture is not the last word. Path rules apply on top, and they can refuse what the tool alone would allow — the assistant cannot write to its own permissions file, to the runtime’s source, or to .env, whatever file_write says. See config/permissions.yaml for the full list; it ships with the app.