Control, trust, and limitations

Gideon can act on real files and services. Match its access to the task, review consequential actions, and understand which controls are actually enforced.

Approvals and task modes

Task modes and approval choices affect tool use. For the native runtime, task-mode restrictions are enforced before approval. External ACP agents under auto-approve can rely on prompt framing rather than the same hard restriction. Keep this distinction in mind when choosing an external agent or broad auto-approval.

Installed apps are code you trust

Apps declare permissions, but the network declaration is advisory: it does not confine an app’s own outbound traffic. An app may install Python dependencies into the gateway environment. Install sources you trust and review the requested access.

Local or private does not mean offline

Configured models, search, channels, and other apps may send data to their services. Temporary and incognito memory modes do not remove those service boundaries.

Review results

Check the actual file, message destination, source, or account affected. An agent’s statement that it completed work is not a substitute for the result you can inspect.

About these guides

These guides describe the current Gideon source and its hosted console. Availability depends on the runtime and connections in use. They are user guidance, not a certification of every third-party integration.

See privacy and approvals for everyday controls and verification for reviewing an outcome.