Can the AI run commands without me approving them?

Only commands on a read-only allowlist, plus any you have explicitly marked as auto-approve. Everything else, and any command containing shell metacharacters such as pipes, redirects or quotes, waits for your approval.

Why not just block dangerous commands?

Because blocklists for shell commands are bypassed in practice through quoting tricks, subshells and abbreviated flags. Octling uses a default-deny allowlist instead and does not try to judge whether a complex shell expression is safe.

What happens if I do not answer an approval request?

It times out and counts as a rejection. The model is told the command was rejected and has to try another approach.

Is there a record of what was run?

Yes. Every command and its output goes into the audit log, per device.

Can I turn approvals off?

Per chat, yes. Auto-approve stops asking for ordinary commands but still stops on a list of destructive ones. Approve-all stops asking entirely, including for rm -rf and shutdown, until you switch it off in the session settings.

Use cases · Security

What an AI is allowed to run on your machines without asking

“You gave an LLM a shell on production?” is the first thing people ask, and it is the right question. This page describes exactly how Octling decides whether a command runs straight away or stops and waits for a person. The short version: nothing runs unasked unless it is on an allowlist of read-only commands, and we do not try to judge whether a clever shell one-liner is safe.

Default deny, not a blocklist

The obvious design is a blocklist: let everything through except rm -rf and friends. Blocklists for shell commands get bypassed systematically, with quote splitting (r'm'), subshells, flag abbreviations, or a harmless-looking tool that happens to execute its input. So Octling works the other way round. A command runs without asking only if it matches an allowlist of read-only commands. Everything else stops for approval.

The order a command is checked in

Any shell metacharacter means approval. If the command contains ; | & > < $ a backtick, parentheses, a quote or a newline, it waits for you. Octling does not parse the pipeline to decide whether it is safe. Your own auto-approve rules cannot override this step.
Your “Always ask” rules. Commands you have marked this way wait for you even if the platform would allow them.
Your “Auto-approve” rules. Commands you trust run without asking.
The platform allowlist. A list of read-only commands that run directly.
Anything else waits for approval.

Personal rules match in one of three ways: the command with any arguments (npm), the bare command only (date), or an exact prefix (docker logs). When both kinds of rule match the same command, the more conservative one wins.

What an approval looks like

The chat shows the target device, the exact command and why it stopped. You approve or reject. If you do not decide in time it counts as a rejection; the model is told it was rejected and has to find another way, it cannot wait you out.

The shortcuts, and what they still stop

Clicking approve forty times in a row teaches people to stop reading, so there are two per-chat shortcuts.

Auto-approve for this chat. Ordinary commands stop asking. Commands on the destructive list still wait for a person: rm with recursive or force flags, dd, mkfs, shutdown and reboot, recursive chmod and chown, systemctl stop and disable, kubectl delete, docker system prune, firewall flushes and a few more. Pushing files to the device also still asks.
Approve all in this chat. Nothing asks any more, including rm -rf and shutdown. It exists because some jobs really are “I am watching, just do it”. It stays on until you turn it off in the session settings, so use it on purpose.

Batches and schedules, where nobody is watching

An unattended batch task follows the same rules, but there is no one to click. A command that needs approval is skipped and noted in the result instead of being run. The other batch mode runs one device first; after you have read the commands it ran, the remaining devices replay that same sequence without asking again.

What this does not protect you from

An approved command can still be wrong. The check is about whether a human saw it, not whether it was a good idea. Read what you approve.
Octling does not snapshot or roll back. Take backups the way you would before doing the same work by hand.
The agent has the rights of the account it runs as. Connect it as an unprivileged user and it cannot do what that user cannot do. Connect it as root and the approvals are the only thing between the model and the machine.
Commands and their output pass through Octling’s servers and are written to the audit log. Do not point it at machines where that is not acceptable.

Questions

Can the AI run commands without me approving them?: Only commands on a read-only allowlist, plus any you have explicitly marked as auto-approve. Everything else, and any command containing shell metacharacters such as pipes, redirects or quotes, waits for your approval.
Why not just block dangerous commands?: Because blocklists for shell commands are bypassed in practice through quoting tricks, subshells and abbreviated flags. Octling uses a default-deny allowlist instead and does not try to judge whether a complex shell expression is safe.
What happens if I do not answer an approval request?: It times out and counts as a rejection. The model is told the command was rejected and has to try another approach.
Is there a record of what was run?: Yes. Every command and its output goes into the audit log, per device.
Can I turn approvals off?: Per chat, yes. Auto-approve stops asking for ordinary commands but still stops on a list of destructive ones. Approve-all stops asking entirely, including for rm -rf and shutdown, until you switch it off in the session settings.