07 / Operate
Approvals & privacy
Muster shows permission requests from supported engines in the conversation. Review approval cards, standing grants and the evidence behind your decisions, and understand how workspace content reaches connected services.
Bots ask before they act
When a supported engine requests permission for a shell command or file edit, Muster displays the request as an inline card in the thread. You have three moves: Allow, Deny, or answer in the thread — often "no, do this instead" is the fastest review of all.
While a card is open, the bot's activity reads waiting-on-you, so a glance at the presence bar tells you who needs a decision. You can answer from the desktop, the web app, or the mobile companions — thin clients built for exactly this: approvals and streaming replies on the go.
Review a bot's configured permissions before enabling recurring work or automatic approvals. Engine capabilities, standing grants and connected tools affect which actions need a new decision.
Always-allow scopes
Re-approving git status forty times a day isn't governance, it's friction. Pressing Always allow on a card grants standing permission per capability — and the grant is as narrow as the thing you actually looked at. Command tools are scoped by program: allowing Bash:git never hands the bot a permanent unattended shell.
The grant's key is computed once, server-side, and echoed back to the client, so the two sides can never disagree about what was granted.
Additional checks can flag recognized destructive or sensitive requests despite a standing grant:
| Backstop | What trips it |
|---|---|
| Destructive | rm -rf, mkfs, shutdown/reboot, fork bombs, git push --force, git reset --hard, DROP TABLE, sudo rm, chmod -R 777 / |
| Sensitive | .env files, .ssh keys, .aws/credentials, .netrc, keychain access, service-account and credentials files — reads that are quiet, permanent, and unrecoverable |
rm. It's a "you probably didn't mean to hand this one over unattended" guard for the obvious catastrophes. Available isolation depends on the selected computer and runtime. Review the execution environment as well as the approval.
The evidence strip
Before you answer a card, Muster shows how this bot's past went with this tool: how many times it was allowed, denied, or auto-settled, and when the last one was.
# what an evidence strip can say, rendered on the card itself:
Bash was allowed 12× before (last 3h ago) — never denied.
Bash history: 4 allowed, 2 denied (last 5d ago).History is scoped to the tool family: what this bot did with Bash:git is evidence about a Bash:npm ask, because both are "this bot running shell commands". For non-command tools like Write or browser_click, exact matches count.
Budgets and the Privacy Shield
Configured token budgets, usage caps and reported costs help you control work. Check the settings available for the selected engine; provider reporting can be incomplete or delayed. You pay your provider for model usage, and connected services can charge separately.
Privacy Shield can mask recognized emails, phone numbers and secret patterns on supported paths, with counts-only records. It does not guarantee detection of every sensitive value or prevent all external processing. Review the content and destination before sending a task.
Where data is handled
- Hosted workspace. The Muster service stores account and workspace records and processes tasks. Model providers and connected apps receive the content needed for the requests you make.
- Provider credentials. Hosted account keys are held server-side in an account-scoped encrypted vault. Existing desktop configurations can keep credentials on the installation. Neither the web app nor a phone interface implies device-only key custody.
- History and recovery. Existing desktop history can remain specific to that installation. Companions can hold sessions, drafts and caches. Signing in or connecting Drive does not by itself establish complete backup, provider-key recovery or automatic cross-device synchronization.
Read Account & device setup and the privacy policy before connecting more accounts or relying on a backup.
Account and device access
Sign in through the Muster app and use the connection steps offered for the intended workspace and installed device version. Codes and links used for pairing or account handoff are credentials: only use ones you requested, do not share them, and obtain a fresh one when they expire.
Existing desktop versions may offer local claim or pairing flows. Those flows do not merge the local workspace with a hosted one. Confirm the account, workspace and computer before sending a task or answering an approval, and revoke access through the controls available to that connection when it is no longer needed.
Connected-app authorization and task approval are separate. Treat material from agent mail, rooms, webhooks and imported teams as untrusted content; it does not grant authority to act.
The layers, in one line
Approval cards record decisions, Privacy Shield applies supported redaction rules, and routines and receipts record work. For recurring bots, sentries and the why-journal, see Automation. For connections and data storage, see Account & device setup.