Agents in bounds.
A harness is only as good as its limits. Manwe's agents work inside the access you grant, ask before anything that matters, and can't remove what you can't get back without you typing it.
You choose how much they ask.
Every chat has an approval mode, set from the shield in the composer and changeable mid-conversation. The mode decides how often an agent checks in. It never widens what the agent can reach.
| What the agent does | Ask for approval | Approve for me | Full access |
|---|---|---|---|
| Read a file you attached or a folder you namedOnly that file or folder, never its parent or siblings. | Runs | Runs | Runs |
| Save, export or edit inside a writable folderRead-only folders stay read-only in every mode. | Asks first | Runs | Runs |
| Routine browser and app work you asked forUnder the host's checks, with your connections. | Asks first | Runs | Runs |
| Delete a folder, database, repository or historyYou type the exact target. No saved permission counts. | Type the target | Type the target | Type the target |
| Sign in to a site or grant macOS accessManwe hands over; it can't grant itself permissions. | You do it | You do it | You do it |
| Wipe a disk or the systemKnown commands are refused outright. | Blocked | Blocked | Blocked |
| Anything outside the access you grantedEnforced by the runtime sandbox, separately from detection. | Out of reach | Out of reach | Out of reach |
Review as you go
Manwe shows each action before it happens, unless a permission you saved already covers it. Useful while you get to know a connection or a task.
Routine work proceeds
Requested work runs under the host's checks. Manwe still asks about real ambiguity, or anything with new consequences you didn't ask for.
Within what you granted
Work runs inside the access you've given without ordinary prompts. Anything destructive still needs your typed confirmation.
Access is granted, not assumed.
An agent starts with nothing. It reaches a file or folder because you pointed it there, and only that far.
An attachment is just that file
Attaching a file gives the task a verified copy of it, not the folder it came from. The original stays as it was.
A named folder, not its neighbours
Naming a folder in a request grants that folder for the task, never its parent or siblings. If the target is ambiguous, Manwe asks.
System permissions stay yours
Microphone, Desktop and other macOS permissions are granted in macOS dialogs. No approval mode can grant them on your behalf.
Some things always need you.
For actions you couldn't easily undo, an ordinary yes isn't enough. You type the exact target, in every approval mode.
Deletion you'd regret
Deleting or emptying a folder, dropping a database table, bulk deletion, removing a repository, bucket or backup, erasing Git history or discarding uncommitted work. No saved permission and no answer from a model can stand in for you.
Bound to that exact action
A confirmation covers one specific request. If the target changes or the task is cancelled, it no longer counts.
Some commands never run
Known commands that wipe a disk or the system are refused outright, whatever the mode.
Mistakes stay recoverable.
Work that goes wrong shouldn't take your files with it.
Nothing is overwritten
If a move would overwrite a file, both are kept. Across drives, the copy is verified before the original is removed.
No blind replays
A write that's known to have failed can be corrected and retried. One whose outcome is uncertain is checked first, never repeated on a guess.
Saved, scoped and revocable
Permissions you save say exactly what they cover, last across restarts, and can be revoked. The model and reasoning you chose never change on their own.
What we don't claim.
Spotting a destructive operation hidden inside an arbitrary script is best effort. That's why the boundary that matters doesn't rely on spotting it: the runtime sandbox confines work to the folders you granted, separately from any detection.
Agents can be wrong. A cloud model sees the task context you send it. A local model runs on your Mac, but research, connected apps and sharing still use the internet. Read results before you send them, and choose the mode that fits how well you know the task. Where your context goes has the details.
Questions
Can an agent reach files I didn't give it?
No. Work runs in a sandbox confined to the files and folders you granted. Naming a folder grants that folder only, and an attachment grants that file only.
Does Full access mean it can delete things?
Full access removes ordinary prompts inside the access you've granted. Deleting folders, databases, repositories or history still needs you to type the exact target, in every mode.
Can Manwe sign in or pay for me?
When a page needs a sign-in or something you should handle yourself, Manwe hands the browser to you, then continues. In Approve for me, purchases and actions needing your explicit decision still ask first.
Can a local model run tools on its own?
Tool calls from local models are proposals. They go through the same validation and approval path as any other model, never straight to execution.
Give your models a world to work in.
Version 0.9.93 · Apple silicon · macOS 14 or later
