Permissions and trust — explanation

What is this about?

An agent like Riker can run commands and change files on your computer. ACP lets the agent ask first: it describes the tool call and offers options (allow once, always, reject once, never). Sidekicks turns that request into a card in the conversation. This page explains why the card looks the way it does; the decisions are in ADR 0004.

Plain words before technical details

The agent's request is technical: a tool kind, a title like bash: rm -f *.tmp, a JSON input. A person who is not a developer needs a sentence — "Riker wants to run a command on your computer" — and the one detail that matters: the command, or the file. The JSON stays available under "Technical details". Commands that can destroy data (deleting, moving, overwriting a file, resetting a git repository) carry a red warning; the list is deliberately short, because a warning on everything is a warning nobody reads.

Why "never" comes before "reject once"

Small local models do not take no for an answer. During the ACP spike, Riker refused once retried forty times; with Sidekicks, refused "never", it stopped asking but kept calling the tool, which mm then refused each time. So:

"Never propose this here" is offered before "Reject once": it stops the questions for the rest of the conversation;
the card always has Stop, and so has the conversation;
when three tool calls in a row have failed, the conversation says the agent is going in circles and offers to stop it.

The request belongs to its conversation

The card appears in the conversation of the agent that asks, not in a window over everything: the other conversations go on, and the question stays next to what led to it. Stopping the agent answers its pending questions "cancelled", as ACP requires.

Rejected alternatives

A modal dialog: it blocks every conversation for one agent's question.
Always allowing in tests and demos: the agents' yolo setting does that on the agent side; Sidekicks shows what it is asked, nothing more.
Guessing the danger of every command: a long list of patterns gives false alarms (grep rm notes.txt); Sidekicks only looks at the program in command position.

How it relates to the rest

The card is drawn in wireframe 4. The events that carry requests are in the reference. What the agent may do in the first place is its own configuration (mm's yolo, bashTool, editTools), not Sidekicks'.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


# Permissions and trust — explanation

## What is this about?

An agent like Riker can run commands and change files on your computer. ACP lets the agent ask first: it describes the tool call and offers options (allow once, always, reject once, never). Sidekicks turns that request into a card in the conversation. This page explains why the card looks the way it does; the decisions are in [ADR 0004](../../adr/0004-conversations.md).

## Plain words before technical details

The agent's request is technical: a tool kind, a title like `bash: rm -f *.tmp`, a JSON input. A person who is not a developer needs a sentence — "Riker wants to run a command on your computer" — and the one detail that matters: the command, or the file. The JSON stays available under "Technical details". Commands that can destroy data (deleting, moving, overwriting a file, resetting a git repository) carry a red warning; the list is deliberately short, because a warning on everything is a warning nobody reads.

## Why "never" comes before "reject once"

Small local models do not take no for an answer. During the ACP spike, Riker refused once retried forty times; with Sidekicks, refused "never", it stopped asking but kept calling the tool, which mm then refused each time. So:

- "Never propose this here" is offered before "Reject once": it stops the questions for the rest of the conversation;
- the card always has **Stop**, and so has the conversation;
- when three tool calls in a row have failed, the conversation says the agent is going in circles and offers to stop it.

## The request belongs to its conversation

The card appears in the conversation of the agent that asks, not in a window over everything: the other conversations go on, and the question stays next to what led to it. Stopping the agent answers its pending questions "cancelled", as ACP requires.

## Rejected alternatives

- **A modal dialog**: it blocks every conversation for one agent's question.
- **Always allowing in tests and demos**: the agents' `yolo` setting does that on the agent side; Sidekicks shows what it is asked, nothing more.
- **Guessing the danger of every command**: a long list of patterns gives false alarms (`grep rm notes.txt`); Sidekicks only looks at the program in command position.

## How it relates to the rest

The card is drawn in [wireframe 4](../../design/04-permission.png). The events that carry requests are in the [reference](../reference/agents-and-events.md). What the agent may do in the first place is its own configuration (mm's `yolo`, `bashTool`, `editTools`), not Sidekicks'.