Roles and permissions
Access is given per computer. Each person has one role on each computer they can use, set by the computer's Owner in Settings → Machine access.
| Viewer | Operator | Owner | |
|---|---|---|---|
| See sessions and their history | ✓ | ✓ | ✓ |
| Read files, changes, diffs and history | ✓ | ✓ | ✓ |
| Start and drive sessions, answer approvals | ✓ | ✓ | |
| Edit, create, rename and trash files | ✓ | ✓ | |
| Stage, commit, switch branches, pull and push | ✓ | ✓ | |
| Open dev-server previews | ✓ | ✓ | |
| Terminals | if allowed | ✓ | |
| Sign the agents in on the computer | ✓ | ||
| Give and change access, rename or remove the computer | ✓ |
Whoever approves a computer's link becomes its Owner. Admins act as Owner on every computer.
Limiting an Operator
For each Operator you can narrow what they can reach:
- Folders: only these folders (and everything inside them). Empty means everywhere. Folders are absolute paths, like
/Users/maya/code. - Agents: only Claude Code, only Codex, or both.
- Terminal: off by default. A terminal can reach anything the computer's user can, past any folder limit, so turn it on only for people you'd trust with the whole computer.
Limits are checked by your server and then again by the computer, which resolves every path to where it really points.