Documentation / Security
Sandbox and permissions
Where the agent can work, what it does without asking and what always waits for your approval.
The agent works inside a perimeter that Yuli's engine enforces on every operation. You decide how far that perimeter extends and how much the agent can do without asking you.
Inside and outside the project
For security, the agent and the project panel can only create, move, copy or delete files inside the open project.
| Where | What happens |
|---|---|
| Inside the project | The agent works according to the configured autonomy. Every change goes through the changes window. |
| Authorized folder outside the project | It can read, or read and write, depending on what you chose. |
| Any other path or a change on your machine | It always asks for your confirmation. |
Give access to another folder
- Open Project → Folder access….
- Click Add folder… and choose it in the system dialog.
- Choose Read and write or Read-only for that folder.
- To revoke it, click Remove access.
Permissions are per project. A new folder is added with read and write access; switch it to read-only if you only need the agent to look things up.
Project trust
The first time you open a project, Yuli asks “Do you trust this project?”. Trusting it allows the project's annotation processors (Lombok) and build tasks (Maven/Gradle) to run for a full analysis.
| Option | What it does |
|---|---|
| Trust | Runs Lombok and Maven/Gradle to resolve dependencies. Full analysis. |
| Restricted mode | Runs no code from the repository: javac analyzes with -proc:none, Lombok is modeled internally and only the already saved classpath is used. |
Change the decision in Project → Global options… → Security → Trusted projects: Trust, Restrict, Forget or Ask again when opening it.
Trust only affects code intelligence and the build. It doesn't change the agent's permissions.
How much the agent does without asking
The engine evaluates every action and assigns it a risk level (low, medium, high or critical) with an explanation and how to undo it. Depending on the authorization preset, it approves only what is safe or asks you.
| Preset | Modify a file | Create a file | Run a command | Delete |
|---|---|---|---|---|
| Cautious | Asks | Asks | Asks | Asks |
| Balanced (default) | Automatic | Asks | Asks | Asks |
| Autonomous | Automatic | Automatic | Automatic | Asks |
While the agent asks you at every step, “Approve everything?” appears above the chat box. Approve everything switches to Autonomous: the agent edits, replaces and runs without asking for approval at each step, and the changes window and rollback can undo it. Keep asking dismisses it.
What raises the risk
- Deleting files or touching paths outside the project.
- Migrations and
.sqlfiles. - Production configuration (
application-prod, Terraform, Kubernetes, Helm). - Dependency manifests.
- Changes to many files at once.
git push,mergeor rewriting history.- Secrets in the content.
- Network access (
curl,scp,ssh,docker push,npm publish,mvn deploy). DROP,TRUNCATEorDELETE FROM.
Advanced autonomy
Agent → Autonomy… opens the rules that let proposals apply themselves. It's off by default: you review every proposal before it reaches the disk.
| Setting | What it does |
|---|---|
| Max files per turn | Above this number, it asks for authorization. |
| Allowed paths (pathsAllow) | Globs where changes can apply automatically, for example src/**. Empty allows any path that isn't denied. |
| Denied paths (pathsDeny) | Globs that always require human authorization, for example **/.env. |
| Require verify pass | Applies automatically only if the project's verification is green. |
The default denied paths include **/.env, **/.env.*, **/credentials*, **/*.pem, **/*id_rsa*, **/.ssh/** and **/migrations/**.
Paths that always ask for confirmation
No preset can skip these cases. Writing to a path that contains .env, credentials, secret, id_rsa, .pem, .git/ or .ssh/ always asks for your confirmation.
In addition, the quality contract protects the contract itself, the Git hooks and the CI files: an agent can't edit them.
Git, CI and DevOps: only if you ask
The agent doesn't commit, push, merge, rebase, tag or run CI operations on its own initiative. Commands such as git commit, git push, gh, glab, az pipelines, az repos and the tools of GitHub, GitLab, Jenkins or CloudBees MCP servers are blocked.
- Yuli detects an explicit request in your message, in Spanish or English: “commit”, “push it”, “push”, “create a PR”, “deploy”…
- With the request, Git is enabled for that session.
- Even so, every action asks for your approval.
Creating a branch or a worktree needs its own explicit request. Even if you ask to “commit and push”, the agent works on the current branch.
Blocked database clients
The agent can't use command-line database clients: sqlplus, sqlcl, sqlcmd, bcp, sqlite3, psql, mysql, mariadb, mongo, mongosh, isql, db2, impdp, expdp, rman and similar. Every query goes through Yuli's tools and their policy. See Secure database access.
In Subscription mode
With Claude Code, Kiro, Codex or Antigravity, the same rules apply. Yuli enforces them through hooks and as an ACP client:
- Inside the project, the agent works without interruptions; outside it, it asks you.
- Git, CI and branches only if you ask for them.
- Secrets are never read.
In Global options → AI and models → AI mode you can turn off Enforce the rules to switch to “Warn only”: Yuli reports what's missing but doesn't block. Git and secrets are always protected.