Permission Prompts

Reading, searching, and listing never need your approval — Cosmo does those instantly, the same as before. But before Cosmo creates, changes, deletes, or sends something — a Jira ticket, a Slack message, a ClickUp task, or one of Cosmo's own destructive actions like deleting a workspace — it stops and asks first.

The three answers

Every prompt shows exactly what Cosmo is about to do, and offers three responses:

• Deny — don't do it. Nothing is remembered: if Cosmo wants to do the same thing again later, it asks you again.
• Allow once — do it this one time. Cosmo will still ask the next time it wants to do this same action.
• Always allow — do it now, and remember this decision so Cosmo doesn't ask about this action again (see Remembering your choice for exactly what "this action" covers).

Destructive actions — deleting, archiving, revoking — and risky commands such as a force-push don't offer Always allow at all. Cosmo asks about those every time.

This is the same shape of prompt Claude Code uses for its own permission requests — three answers, no separate "approve" step to think about.

What counts as "needs asking"

Anything that reads or looks something up — searching Jira, listing files, checking a calendar — runs immediately, with no prompt. Anything that writes — creating a ticket, posting a message, deleting a page — asks first, the first time. Cosmo's own built-in suggestion cards (the "here's what I could do next" prompts) are not permission requests — they never blocked anything, and still don't.

Scheduled Routines

A Routine runs unattended, with nobody there to answer a prompt — so routines don't ask at all. Setting up a routine to do something is itself the approval: describing what you want it to do, on the schedule you picked, is the moment you decide it's allowed to happen without you watching.

Remembering your choice

"Always allow" is remembered on this device, for you, in the organization you were working in when you chose it. Switching to another organization, or someone else signing in on the same computer, starts from nothing. Signing out of the desktop app clears every remembered choice.

What one "Always allow" covers depends on what was asked about:

• A connected tool's action (Jira, Slack, ClickUp, …) — that one action of that tool, whatever it is called with. Allowing "create Jira issue" lets Cosmo create any Jira issue without asking, but does not also allow "edit Jira issue" or "delete Jira issue"; each is asked about independently the first time it comes up.
• A command on your computer (git, npm, …) — that exact command, with exactly those arguments. Allowing git status does not allow git push, or even git status with different options.