Agents

Permissions and file access

How LoCrew controls what an agent may change: Read only, Ask first and Full access, the approval dialog, work sessions, project directories, directory locks, and what these limits do not protect against.

You decide what each agent may touch. Permissions are layered: what the agent may do in files, which MCP tools it may call, whether other agents may wake it, and how long and how expensively it may run.

Limits, not a sandbox

Agents can read and change files on your computer. File access levels map onto each CLI's own permission system, and that CLI runs as your user account. They are limits, not a sandbox. Use a virtual machine or container if you need real isolation.

#File access levels

Only Claude Code and Codex agents work with files. Model and external agents are always read only.

Level	What the agent may do
Read only	May read files but change nothing.
Ask first (default)	Reads freely. Every write waits for your approval, unless you open a work session under Settings → Write access.
Full access	May change files without asking.

Set it in Create agent (step 3) or in the agent's editor. The agent is also told its level in its instructions.

#Approving a write

When an Ask first Claude Code agent wants to edit a file, create one or run a command, or when any agent calls an MCP tool granted as Ask first, LoCrew opens an approval dialog:

The title says what it wants: Agent wants to edit file, create file, run a command, or use server → tool.
File changes show a diff (New file for new files). Commands show the command. Tool calls show their arguments.
If more requests are queued, a chip shows N more waiting.

Button	Effect
Allow once	Allows this one operation.
Allow for 1 hour	Opens a one-hour work session and allows it.
Until I end it	Opens a work session that lasts until you end it.
Deny	The agent is told You denied this operation.

Apply to every agent working in this directory widens a work session from the agent to everyone in its folder. Closing the dialog counts as a denial. Closing the window or quitting LoCrew also refuses pending approvals.

Note

This dialog is tested against the real Claude Code CLI. Codex agents set to Ask first use Codex's own approval policy instead, and the code does not show LoCrew's dialog for them.

#Work sessions

A work session lifts Ask first for a set time, for one agent or for everyone working in its directory. Sessions are never saved to disk: closing LoCrew always returns to asking.

Open one from the approval dialog, or from Settings → Write access → Open a work session:

Field	Values
Agent	Only agents set to Ask first
Lasts	15 minutes, 1 hour (default), 4 hours or Until I end it. Timed sessions last at most 12 hours; Until I end it lasts until you end it or close LoCrew.
Covers	This agent only, or Its working directory

While any session is open, the sidebar shows a Write access on badge: Agents are writing without asking. Click it to see open sessions, their time left, and End or End all sessions.

Work sessions never raise a Read only agent and never cover MCP tools.

Message	Meaning
Agent is set to read only. Change its access level if it should write at all.	Sessions only apply to Ask first agents.
Agent already writes without asking.	The agent has Full access.
Agent is working in more than one directory right now (…), so "this directory" is ambiguous.	Open the session for the agent instead, or wait for a run to finish.
That agent has no working directory, so there is nothing to open up.	Model and external agents have no folder.

#Project directories

A channel can set a Project directory in its settings. Agents in that channel then work there instead of in their own directory, so they all see the same project. Leave it empty to let each agent use its own.

Note

According to the code, the diff in an approval dialog, and a directory-wide work session opened from that dialog, are based on the agent's own directory, not the channel's project directory. A session opened from Settings → Write access uses the directory of the agent's current run, which can be the channel's.

#Directory locks

Any run that may write takes a lock on its directory, so only one agent writes in a folder at a time. A run waiting for it shows Received — waiting for the workspace, and the agent's status is Queued. The Working directories part of the channel's Details panel shows who holds the lock. The lock is advisory: it coordinates LoCrew's own agents, not other programs.

#MCP tool grants

Agents get no MCP tools unless you grant them, per tool. New grants start as Ask first, which shows you every call; switch a tool to Allow to let it run without asking. Grants are re-read on every call, so revoking one takes effect immediately. See MCP tools.

#Conversation permissions

Set in the agent's Permissions section:

Setting	Default	Effect
Other agents can hand work to it	On	When off: Agent is not permitted to be woken by other agents.
Can update tasks it is assigned	On	When off: Agent is not permitted to update tasks.
Max turns per message	24	Claude Code and model agents stop at the limit.
Timeout (minutes)	10	Shortened by the global Max task duration. A timed-out run ends with The execution timed out.
Spend ceiling (USD)	2	Per run. Claude Code and Codex only.

Global limits on hops, queues and spend per chain are in Limits.

#What these controls do not protect against

An agent with Full access, or one inside a work session, can change anything its CLI can reach as your user account.
A Read only agent can still read every file the CLI can read. Selecting skills limits what is offered, not what can be read.
MCP servers you add run with your user account's permissions. Local servers never start without your approval of the exact command.
Spend ceilings only cover runtimes that report a price: Claude Code and Codex.