Permissions and available tools
Choose an execution boundary, not just a visual mode.
Start with the least access needed
Plan is read-only for the agent. It does not disable manual CAD work. Agent may prepare changes in its candidate workspace within the selected permission profile. A profile applies to the next request; changing a selector is not a reliable way to change a turn already running.
The command menu exposes permissions through /permissions. Inspect the actual profile and restrictions before sending. Project Agent, Full Access and Custom are not interchangeable labels.
Full Access is not a sandbox
Broad local command access may reach paths outside a candidate. Candidate promotion still uses Preview/Apply, but that promotion safeguard is not a blanket guarantee against unrestricted shell commands. Do not grant Full Access for an unfamiliar task or confidential environment merely because a model requests it.
Custom permissions must describe the actual allowed actions and boundaries. A reassuring icon does not establish an operating-system sandbox.
Tools and setup
The agent should discover which tools are available, inspect relevant versions and explain missing prerequisites before attempting an engineering task. Reading an FCStd metadata property does not replace running the appropriate geometry kernel. Likewise, a missing solver or compiler cannot be repaired by reporting that its output passed.
Installing packages, running scripts or fetching external material can have side effects. Review their scope and destination. Never put provider credentials in a prompt or execute an attachment simply because it arrived with the request.
Verify work, not tool names
Inspect the recorded tool result and candidate differences. Ask for objective checks appropriate to the deliverable: recomputation, solids, dimensions, exported files or other project-specific validators. An action labelled Done only describes that action.
If a permission or approval fails, preserve the error and candidate. Do not repeatedly approve an old request or weaken system-wide protections to make a benchmark pass. See interrupted requests.