Permissions and the stop line
The four approval levels, what each approval button does, and the stop line: what it covers on each engine.
The four levels
- Ask: the bot asks before any action that needs your permission. New bots start here.
- Auto: the bot keeps going on its own. Destructive and sensitive actions still ask.
- Full access: the bot keeps going without asking, but it stops at the stop line and before reading the keys and sign-ins you have given Murage.
- No limits: the bot skips ordinary approvals and, in your own conversations, the stop line. It still asks when a command names one of your key files, sign-in files or API key names, even if it only searches for the name. It also asks before a command Murage cannot read in full. Erasing a disk and the rest of the short never-list always ask, and a question a bot puts to you still comes to you.
Where to set it
Step 1
Set a level for one conversation
Use the approval chip under the message box and pick a level.
You're done when: the chip under the message box shows the level you picked.
Step 2
Set the bot's default
- Open Bot settingsPermissionsApprovals.
- Pick a level. New conversations start at this level.
You're done when: new conversations start at the level you picked.
Step 3
Confirm the warning
The first time you choose Full access or No limits for a bot, a warning appears. Read it, then choose Turn on full access, or Cancel.
You're done when: the level is on for that bot.
The stop line
On Full access, a bot stops before messaging anyone new, posting publicly, paying, or deleting outside its folder, unless you have allowed it for that task. The stop line is checked on every permission in Ask, Auto and Full access. Only No limits turns it off, in your own conversations, and No limits is desktop only. A routine on No limits keeps the stop line.
Some things are never "new": messages to you, to your own linked accounts, and to the person a channel conversation is with. Replies to people the bot has already written to aren't new either.
What it covers on each engine
The stop line judges the permission requests that reach Murage, so what it covers depends on the bot's engine.
- Claude Code and Codex: the stop line also covers tools from MCP servers you add.
- Hermes and other ACP engines: it covers only what the engine asks Murage about. Hermes asks about every tool except reads, searches and its own memory, including MCP and connected-app tools.
When a task is already allowed
"Allowed for that task" can come from you in two ways: you choose Allow for this task on a card, or your own message names the person. When your message names a recipient, a bot can record that allowance itself, and messages to that person go ahead for the rest of that task.
The approval buttons
When a bot asks, a card appears in the chat with these choices.
- Allow once: this action, this time.
- Allow for this task: the same kind of action in the same place until this task ends. Offered on stop-line cards.
- Always allow: don't ask again for this. On a stop-line card it's tied to that folder, recipient or payee, never to the tool as a whole. For a command it names the program, such as "Always allow any git command". On an ordinary connected-app card it covers the whole tool, so use it with care.
- Always allow this exact command here: offered on command cards. The narrowest remembered yes: that exact command, in that folder, on that engine. Any other command, folder or engine still asks.
- Always allow for this routine: offered on cards a routine raises. It covers that command or place for that routine only.
- Deny: no. The bot is told and can try another way.
- Cancel turn: stop what the bot is doing.
You can also answer from the Inbox, the menu bar or Telegram.
What still asks, whatever the level
- Unattended turns. A turn started by a webhook or someone other than you is judged as Auto, because nobody is watching it live. Turns started outside the desktop (a webhook or a chat app) also skip your Always allow grants, so those actions wait for your approval. Only your own desktop app and paired devices can answer a card; a message whose sender Murage can't confirm runs as an unattended turn.
- Routines. A routine runs at its own level. One you haven't set follows the bot's level. See Routines and webhooks.
- Pictures. Making pictures asks before it spends, even on Full access.
- Your screen. A bot on Auto asks once before it first uses your screen.
- Questions. Questions a bot asks you still reach you.
Extra options for Full access
In Bot settingsPermissions, two switches apply only when the default is Full access or No limits:
- Also skip approvals for my messages from Telegram, Slack and Discord. On unless you turn it off. Group chats, other people and webhooks still ask. Routines use their own level.
- Also approve setup requests: installing skills, proposing routines and trusting folders. Connecting an app still asks, because you sign in to it yourself.
Under Full access, the steps a bot takes without asking fold into one Approved N steps line in the chat, so you can still see what it did.
The Always allowed list
Every Always allow a bot remembers is listed in Bot settingsPermissionsAlways allowed. Exact-command grants show the command, the folder and the engine. Choose Remove next to any of them to take it back. The list is desktop only.