> ## Documentation Index
> Fetch the complete documentation index at: https://cogno.studio/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Control access during agent runs

> Choose Session access, set Machine limits, and understand when Cogno refuses a tool call.

Choose how much native access an attended Session may request, then cap attended and autonomous work for each Machine. Cogno applies the more restrictive setting whenever a Session choice and a Machine maximum differ.

## Choose access for attended Sessions

Use the shield menu beside the composer to choose the Session access level.

| Choice                | What it allows                                                                                      |
| --------------------- | --------------------------------------------------------------------------------------------------- |
| **Ask for approval**  | Keeps work in the workspace and asks before actions that need approval.                             |
| **Auto in workspace** | Works in the workspace without pausing for approval. Access outside the workspace stays restricted. |
| **Full access**       | Runs without approval and may reach files or credentials outside the workspace.                     |

On first use, a Session starts with **Auto in workspace** unless the Machine maximum is lower. After you choose another level, Cogno remembers that choice for the same Machine in this browser. If the Machine maximum is lower the next time you open a Session, Cogno starts at the maximum instead of restoring a higher choice.

<Note>
  A Machine maximum is a ceiling, not a default. Raising the maximum to **Full access** does not automatically raise a new Session from **Auto in workspace**.
</Note>

## Set access limits for a Machine

<Steps>
  <Step title="Open the Machine settings">
    Open **Settings → Machines**. Find the Machine whose limits you want to change.
  </Step>

  <Step title="Set the attended maximum">
    Under **User-initiated maximum**, choose the highest level a person may select for Sessions started or continued on that Machine.
  </Step>

  <Step title="Set autonomous access">
    Under **Cogno autonomous access**, choose the level for unattended queue turns on that Machine.
  </Step>
</Steps>

If Cogno cannot save a setting, the page keeps the error visible and offers **Try again**.

## Confirm Full access once per Machine

The first time you choose **Full access** for a Machine in this browser, review and accept the warning. Cogno remembers the confirmation for that Machine, so changing a Session or Machine setting to **Full access** later does not open the same dialog again.

Clearing browser storage or enrolling the computer as a new Machine removes the remembered confirmation. Cogno then asks again the next time you choose **Full access**.

<Warning>
  **Full access** removes native approval safeguards. An agent may run commands, change files outside the workspace, and reach credentials available to the operating-system account.
</Warning>

**Full access** requires Engine protocol 3 or later. On an older Engine, the option is disabled and the Machine settings explain that Engine must be updated.

## Understand what can stop tool access

Cogno checks tool access against the current [Workspace](/docs/concepts), Project, Machine, and run. A token issued earlier does not preserve access after those relationships change.

| Change                                                                                | Result                                                        |
| ------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
| Membership is removed, the profile is deleted, or the Project is archived             | Subsequent tool calls are refused.                            |
| A Task moves to another Project, its Environment changes, or its known Session closes | The old execution context no longer authorizes calls.         |
| The Project owner changes during a taskless Project Run                               | The former owner's run cannot continue using the old context. |
| The Machine credential is revoked or the Machine is removed                           | An old run token cannot restore access.                       |
| A queue run finishes or starts a new retry attempt                                    | The earlier attempt's token is refused.                       |
| Authorization cannot be checked                                                       | Cogno refuses the call instead of assuming access.            |

Tool access also depends on the member's current permission for the requested operation. A tool's presence in the catalog is not permission to execute it. External integrations still require their own connection and provider permission checks.

## Discover available Project sources

Source discovery separates connections even when they contain the same resource ID. It returns only selected targets still present in that connection's current catalog. Personal connections are visible only to the trusted actor who owns them; without an actor, discovery returns shared connections only. Discovery does not replace the permission check performed when a tool reads the source.

## Keep the execution components updated

Queue claims and attended-run token requests require an explicit execution-policy acknowledgement. A Machine running an older Engine receives `execution_policy_upgrade_required` before a new queue run is claimed or a token is issued. Update the execution components together with the web and desktop application; do not disable the access checks to restore compatibility.

<Warning>
  Cloud refusal does not stop a coding-agent process already running on your computer. Older desktop and Engine combinations can also continue local attended execution after a token request fails. A cloud-only update does not guarantee that those older local processes have stopped or enforce the saved policy.
</Warning>

## Retry within the correct run

Attended writes require an execution-turn identity supplied by Engine. Read-only access can precede Session registration, but the absence of that turn identity does not authorize a write. A later explicit turn has a different identity even if the transport restarts its request numbering.

Queue retries retain the same logical work identity. A new request identifier is not a new permission and does not make a previously uncertain external result safe to resend.

## Related docs

* [Run an agent on a Task](/docs/agents)
* [Set up Machines](/docs/machines)
* [Work with Projects](/docs/projects)
* [Troubleshooting](/docs/troubleshooting)