# Permissions and available tools

Canonical: https://synthcrew.io/docs/permissions-tools

## Start with the least access needed [#start-with-the-least-access-needed]

**Plan** is read-only for the agent. It does not disable manual CAD work. **Agent** may prepare changes in its candidate workspace within the selected permission profile. A profile applies to the next request; changing a selector is not a reliable way to change a turn already running.

The command menu exposes permissions through `/permissions`. Inspect the actual profile and restrictions before sending. Project Agent, Full Access and Custom are not interchangeable labels.

## Full Access is not a sandbox [#full-access-is-not-a-sandbox]

Broad local command access may reach paths outside a candidate. Candidate promotion still uses Preview/Apply, but that promotion safeguard is not a blanket guarantee against unrestricted shell commands. Do not grant Full Access for an unfamiliar task or confidential environment merely because a model requests it.

Custom permissions must describe the actual allowed actions and boundaries. A reassuring icon does not establish an operating-system sandbox.

## Tools and setup [#tools-and-setup]

The agent should discover which tools are available, inspect relevant versions and explain missing prerequisites before attempting an engineering task. Reading an FCStd metadata property does not replace running the appropriate geometry kernel. Likewise, a missing solver or compiler cannot be repaired by reporting that its output passed.

Installing packages, running scripts or fetching external material can have side effects. Review their scope and destination. Never put provider credentials in a prompt or execute an attachment simply because it arrived with the request.

## Verify work, not tool names [#verify-work-not-tool-names]

Inspect the recorded tool result and candidate differences. Ask for objective checks appropriate to the deliverable: recomputation, solids, dimensions, exported files or other project-specific validators. An action labelled Done only describes that action.

If a permission or approval fails, preserve the error and candidate. Do not repeatedly approve an old request or weaken system-wide protections to make a benchmark pass. See [interrupted requests](/docs/interrupted-runs).