SAFETY BOUNDARIES
Control is designed into the task lifecycle.
The current technical preview combines inspection, bounded execution modes, explicit one-time choices and visible task history. These controls reduce risk; they do not make beta software risk-free.
- Public build
- v0.9.5
- Verified platform
- macOS · Apple silicon (arm64)
- Safety posture
- Risk-reducing controls · not a zero-risk guarantee
Task lifecycle
A task remains inspectable from intent to recovery.
Stopping microphone capture and aborting an active task are different actions. Use Abort when execution itself must stop.
- Tell
- Review
- Select mode
- Approve if needed
- Execute
- Inspect
- Stop or recover
Ten current safety controls
Open a control to see its platform, first verified public build, product entry point and exact limitation.
01Editable transcriptBeta
Inspect voice transcription in the on-demand editor; typed text, paste and transcripts share the same composer.
- Platform
- macOS · Apple silicon (arm64)
- From build
- v0.9.5
- Where you see it
- Task panel → Type or edit
- Limit
- Ordinary voice submits directly while the editor is closed. There is no second spoken confirmation, and speech cannot act as a permission button.
02Plan previewBeta
Inspect the task interpretation, scope and read-only plan before a write turn.
- Platform
- macOS · Apple silicon (arm64)
- From build
- v0.9.5
- Where you see it
- Task panel → Ask before act plan
- Limit
- The plan is an intent review, not a technical allowlist for every file operation inside workspace-write.
03Read-only modeBeta
Read-only and planning turns use the real read-only sandbox and a never approval policy.
- Platform
- macOS · Apple silicon (arm64)
- From build
- v0.9.5
- Where you see it
- Task panel → Execution mode
- Limit
- Read-only mode cannot complete work that requires a project write.
04Sensitive-action checksBeta
Expanded scope, external paths, system control, destructive or uncertain requests do not become silent auto-approvals.
- Platform
- macOS · Apple silicon (arm64)
- From build
- v0.9.5
- Where you see it
- Active task → Allow once / decline card
- Limit
- Only requests supported by the current execution path can show a one-time choice; others may be refused or enter recovery.
05Change reviewBeta
Inspect a bounded project diff after a writable task finishes.
- Platform
- macOS · Apple silicon (arm64)
- From build
- v0.9.5
- Where you see it
- Settings → Automatic snapshot… → Task review
- Limit
- This follows the optional snapshot setting. When it is off, Pip creates no hidden review.
06SnapshotsBeta
Capture a fixed project's file and Git-index baseline before a writable turn.
- Platform
- macOS · Apple silicon (arm64)
- From build
- v0.9.5
- Where you see it
- Settings → Automatic snapshot, diff & one-click Undo
- Limit
- Off by default. External clean/process filters, linked worktrees and an out-of-project .git directory are rejected.
07UndoBeta
After a fresh preview and confirmation, restore the project files and index actually captured by the snapshot.
- Platform
- macOS · Apple silicon (arm64)
- From build
- v0.9.5
- Where you see it
- Task review → Undo
- Limit
- It refuses newer manual edits and cannot reverse Git history, remote actions, app automation or external originals.
08Activity recordBeta
Show real task states, approvals, completion or failure, and the sanitized final answer.
- Platform
- macOS · Apple silicon (arm64)
- From build
- v0.9.5
- Where you see it
- Task panel → Timeline and final result
- Limit
- This is a visible record for the current task, not a complete audit log for third-party systems.
09Least privilegeBeta
Writes stay inside fixed-project workspace-write; external objects require one-time approval and private staging.
- Platform
- macOS · Apple silicon (arm64)
- From build
- v0.9.5
- Where you see it
- Fixed-project sandbox and one-time attachment cards
- Limit
- Workspace-write is a project boundary, not an exact allowlist of files named by an approved plan.
10Fail closed / stop any timeBeta
Stop forward progress when the thread, project, approval delivery or rollback cannot be proven, and show a recovery state.
- Platform
- macOS · Apple silicon (arm64)
- From build
- v0.9.5
- Where you see it
- Task panel → Abort / Recovery required
- Limit
- Stop recording ends only the microphone. Use Abort for active execution and wait for real stop evidence.
Permission and data boundaries
Access is attached to a feature or task.
Permission model
- Microphone
- Purpose: Local speech capture and transcription
Requirement: Optional
Request: Only after Start recording
Turn off: System Settings → Privacy & Security → Microphone - Files and folders
- Purpose: Read the folder or items you explicitly choose
Requirement: Task-dependent
Request: After selection or an Allow once card
Turn off: Remove the attachment, decline the card, or revoke Files and Folders access - Automation
- Purpose: Control another app for an approved task
Requirement: Task-dependent
Request: Only when the task reaches that app
Turn off: System Settings → Privacy & Security → Automation - Accessibility
- Purpose: Not required for ordinary recording, text input or the global shortcut
Requirement: Normally not required
Request: Only if a separate execution tool genuinely requests it
Turn off: System Settings → Privacy & Security → Accessibility - Screen Recording
- Purpose: Not required by Pip's ordinary task panel
Requirement: Normally not required
Request: Only if a selected external tool needs visual access
Turn off: System Settings → Privacy & Security → Screen & System Audio Recording
Data flow and third parties
- Voice
- Microphone capture and transcription run locally. Opening the panel alone does not start recording.
- Task execution
- Task text and approved context go to the execution service the user selected. Full project and computer work uses the signed-in Codex App Server in the current build.
- External attachments
- Dropping an item does not read or send it. After an exact Allow once choice, a selected-object-only staging copy can be made; the external original stays read-only.
Beta limitations
- An approved Ask plan is not a technical per-file allowlist: App Server does not expose a pre-gate for every built-in edit already permitted inside workspace-write.
- Automatic snapshot, change review and Undo are optional and off by default.
- Undo covers captured fixed-project files and the pre-task Git index only. It does not reverse remote actions, app automation or external effects.
- A technical preview can still fail or cause loss. Keep backups and begin with non-sensitive, read-only work.
Actions treated as sensitive
These categories require a deliberate one-time choice when the current path supports them, or are refused. Spoken or typed model text is not itself permission.
- Deleting or overwriting files
- Bulk moving or renaming
- Sending messages, email or published content
- Changing accounts or permissions
- Payments or purchases
- Installing software or running elevated commands
- Uploading local content to a third-party service
User practice
Use the preview safely
The product controls are most useful when the person running the task checks the same four things every time.
- Start in Read only and keep important files backed up.
- Check the execution mode, scope and exact permission card.
- Do not treat spoken words or model text as a permission grant.
- Abort when the task or requested access no longer matches your intent.
Verify the current build before relying on a control.
Product status records what is public today. Privacy and Terms explain the wider legal and data boundaries.