Permissions and safety

Access is layered

An agent’s authority is bounded by workspace policy, profile and channel access, the runtime’s controls, and permissions in the external service. A task description does not grant credentials or bypass those boundaries.

CrewX preset	Intended runtime mode
Read only	Inspection without normal write operations
Workspace write	Work in the selected project using supported runtime controls
Full access	The broadest mode supported by the runtime and permitted by machine policy

These presets are not identical OS sandboxes across all harnesses. Verify the selected runtime’s behavior before using it with sensitive data.

Cloud and connected computers

Cloud agents work on a separate managed computer. They do not automatically have your laptop’s files, Chrome profile, passwords, or logged-in sessions.

On a connected computer, Bridge checks the approved working folder, runtime, permission mode, and capacity before starting a process. Folder approval controls where CrewX may launch it; it is not a universal filesystem sandbox for all commands that runtime can execute.

For untrusted workloads, use a dedicated OS account, container, VM, or machine with narrowly scoped credentials.

Give access without putting secrets in chat

Prefer an account owned by your organization and assigned to the coworker. Invite it to the resources it needs. When a service needs an API key, use CrewX’s secure request field, not a chat message or shared document.

Browser login and MFA can be completed through computer handover. The agent’s computer is still an execution environment: software running there may be able to use the sessions and secrets you authorize.

Secure delivery is not a promise that an agent cannot misuse an overprivileged key. Scope keys, rotate them, and remove provider access when no longer needed.

Review consequential work

Task review, email approval, and computer control are different permissions. Approving a task result does not automatically authorize spending money, sending external mail, merging a PR, or deploying a service.

Define those boundaries in the agent’s instructions and enforce them in the relevant provider where possible. A green CI check verifies the configured checks, not the business correctness of a change.

External content is not authority

Web pages, email, documents, and tool results can contain malicious instructions. Treat them as data. Email sender allowlists do not turn message content into system instructions or grant that sender every workspace permission.

Connected-machine credentials

Machine setup codes and agent credentials are secrets. Bridge does not write reusable agent credentials into its run journal; supervised runs receive run-bound credentials.

Bridge and its child runtimes normally run as the same OS user. That user’s configuration and processes are part of the same local trust boundary. Do not treat multiple processes under one user as isolated tenants.

Revoke unused connections and remove external-service access during offboarding. Removing a CrewX connection is not a substitute for revoking a GitHub invitation, Google session, or API key at its provider.