Security

Run modes

Choose how often the agent stops to ask before it acts.

Run modes decide which tool calls proceed and which ones wait for you. That covers terminal commands, connected tools, and fetches. Open Settings, then Agents, then Approvals & Execution.

Three choices

• Auto-review is the everyday choice. Familiar actions proceed. Riskier ones are checked, and Tetrarch asks when it is unsure.
• Allowlist runs only the actions you have named. Everything else waits.
• Run everything never asks. Use it only if you accept that.

Auto-review can be wrong in either direction. It is a convenience, and you can still be asked when a call looks off.

Say what must wait

Write ordinary sentences about actions that should always stop for you, or ask Tetrarch to record them. A personal list applies everywhere you work. A project list can be checked in. A team policy overrides both.

Every command that talks to a cloud account should wait for my approval.

The project boundary

Terminal commands can stay inside the project, away from the rest of your machine. If a command needs more than that, Tetrarch says so and asks. You can name extra folders or sites a command may reach.