- Docs
- Safety
Protection levels
Choose off, minimal, balanced or strict for each session, see risky commands blocked before they run in Claude Code and Codex, allow intended exceptions per project, and let repeated blocks pause a session.
Show transcriptHide transcript
Approvals are for decisions. Some things should never happen at all. That’s what protection levels are for.
Choose a level for each session: off, minimal, balanced, or strict. Or set a default for a project.
Minimal guards Arcon itself, your secrets, and data leaving the machine. Balanced adds production deploys, force pushes, sudo and more.
Strict keeps the agent inside the project. Rules decide before the command runs, for Claude Code, and now for Codex through its hooks.
No model can talk its way around them. You’re notified, and every blocked action is listed in Security.
If something is intended, allow it for that project: a path, a program, a host, or a branch. Arcon’s own files can never be unlocked.
And three blocks in ten minutes pause the session, until you resume it. Blocked before it ran. Arcon.
The four levels
- Off. Nothing is checked. Nothing is blocked and nothing is logged, as if Arcon weren’t there.
- Minimal. Protects Arcon, your secrets and your files from leaving. For agents that are already sandboxed.
- Balanced. Work freely, but no risky changes outside the project.
- Strict. Only the project and temp folders. Anything outside is blocked unless the project allows it.
| What the agent tries | Off | Minimal | Balanced | Strict |
|---|---|---|---|---|
| Arcon’s own files and hooks | Runs | Blocked | Blocked | Blocked |
| Secrets: .env, SSH keys, credentials | Runs | Blocked | Blocked | Blocked |
| Sending data out: uploads, piping env | Runs | Blocked | Blocked | Blocked |
| Other people’s folders | Runs | Runs | Blocked | Blocked |
| Config and dotfiles, /etc, shell profiles | Runs | Runs | Blocked | Blocked |
| sudo, infra, production deploys | Runs | Logged | Blocked | Blocked |
| Force pushes and protected branches | Runs | Logged | Blocked | Blocked |
| Anything outside the project and temp folders | Runs | Runs | Runs | Blocked |
“Logged” means Minimal notes it without stopping it. Balanced also stops hidden or unreadable code (commands built at run time, piping a download into a shell), because Arcon can’t see what it would really do.
Choosing a level
The most specific setting wins: the session, then the project, then your default.
- For a session: the protection chip in the session header, or the picker when you start a session remotely.
- For a project: Security → Project boundaries, which is also where exceptions live.
- Your default: More → Security → Default for new sessions on the phone, or Security on the web. It’s used when neither the session nor its project chooses a level, and your computers pick up a change right away. New accounts start at Off.
When something is blocked
The agent gets a plain “no” with the reason, and nothing runs. You get a notification (“Blocked before it ran”) that says what was tried and why, and every blocked action is listed under Security, where you can open the session.
Project exceptions
If something is intended, allow it for that project instead of lowering the level. An exception names exactly what’s allowed:
| Allow | For example |
|---|---|
| A path (read or write) | A shared folder outside the project, or a specific .env file the project really needs |
| A program | A deploy or infrastructure tool you do want this project’s agent to run |
| A host | A server or database the agent may connect to, or send files to |
| A branch | A branch the agent may push to even though it’s protected |
Arcon’s own files can never be unlocked, and neither can the rules about hidden or unreadable code (hidden code, commands built at run time, piping a download into a shell), because Arcon can’t see what they would really do. Protected branches are main, master and release* unless you change them.
Automatic pause
Three severe breaches in ten minutes (Arcon itself, secrets, data leaving, hidden code, system changes) pause the session until you resume it. Ordinary blocks stop only that one action. A pause is never silent: it’s recorded in Security and pushed to your phone.
Codex
With its hooks installed and trusted (Connect Codex), Codex’s tool calls are checked before they run, like Claude Code’s. Without the hooks, Arcon only notices a breach afterwards, from Codex’s session log, and tells you.