Permissions

OpenCorvus has one authorization setting for new Tasks and direct Sessions:

• Full access is the default. Permission-bearing Tool, Model Context Protocol (MCP), Browser, Computer, plugin, network, process, write, publication, schedule, and external-service invocations execute without an OpenCorvus approval prompt.
• Ask me is an explicit operator choice. Permission-bearing invocations pause before execution.

Identity, authentication, canonical-path, stale-runtime, Task ownership, and data-integrity checks remain active in both modes. Tool installation and agent capability assignment are separate controls; they decide what can be offered, not whether a concrete invocation is approved.

Ask me decisions

Each request displays the provider, Tool, effect class, normalized arguments with secrets redacted, and the owning Task or Session. Depending on the effect, it offers:

• Allow once for this exact invocation;
• Allow for this Task for the exact typed scope and current Task;
• Always allow this exact scope for eligible project-scoped reads, writes, processes, and network reads;
• Deny.

Changed arguments, destination, path, provider digest, Tool, or effect class create a new request. Destructive, credential-release, and external-effect calls cannot receive a project-wide grant.

Durable history and recovery

Requests, decisions, grant uses, revocations, and execution outcomes are appended to the permission ledger. The settings page lists active grants and recent history and can revoke a grant. Pending requests survive runtime restart; they do not time out or silently change mode. If a runtime stops after an effect starts but before its outcome is known, OpenCorvus records an unknown outcome and will not blindly repeat it.

The mode is frozen when a Session first performs a permission-bearing invocation. Changing the setting affects new work.