Never allowed and Always ask

Never allowed

A command that matches this list does not run. Approving it does not help, a trusted category does not help, and a Zero-touch instruction does not help. It is the one rule that nothing overrides.

The built-in list covers the kinds of action that cannot be undone or that disable protection:

• Erasing or reformatting disks and partitions, and wiping free space.
• Recursive deletion of the Windows folder, user profiles or a Unix system or home root.
• Switching off real-time malware protection, or the system-integrity features on a Mac.
• Changing the boot recovery configuration.
• Deleting the system parts of the registry, or deleting local user accounts.
• A small number of other commands that are destructive by design.

You add your own entries as plain text. A command matches if it contains your text anywhere, ignoring case, and a chained command cannot hide an entry after a semicolon. Only an Administrator edits the list.

Always ask

Commands on this list wait for a person even on a machine set to "Auto-run everything". The built-in set covers deleting folders recursively, restarting or shutting down, stopping remote access, and deleting backups. You can extend it with your own text in the same way.

It governs what the AI proposes in conversation. A Zero-touch Autopilot instruction follows its own path, described on the trust levels page.

Protected file types

You can name file types the AI must never open, from presets such as documents, email files, keys and secrets, and photos and video, or by typing an extension. Deleting, moving, renaming and listing those files keeps working so cleanup tasks still work. Reading, searching inside, copying or compressing them is refused, even if a technician approves it.

This protects against the AI reading a file, but it cannot promise that no content of a protected file ever reaches the AI, because a command that sweeps up a whole folder might include one. The page says the same.

Trying a command

The Security page has a walkthrough where you pick a command, choose a machine setting and see which check decides it. It uses the same classifier the live system uses, so it is a reliable way to confirm a rule does what you meant. Its risk labels are Read-only, Routine change, High blast radius and Never allowed.