# Serein permission model

In Serein, every agent task can read web pages, and nothing more. Clicks and typing, the user's sign-ins, project edits and Mac actions are off until the user grants them, and Stop takes a task's browser access away at once.

## What each thing needs

| Action | At the start of a task | How it is allowed |
|---|---|---|
| Read a page in an agent tab | On | Always |
| Click and type on a page | Off | A grant by the user |
| Use the user's signed-in sessions | Off | "Use my sign-ins", a grant for one task that the user can take back |
| Change files in a project | Off | A grant for edits; then each edit needs approval: allow once, always allow in this project, or deny |
| Act in another Mac app | Off | Each action waits for the user's approval |
| Run a Mac script (Calendar, Reminders, Notes, Finder) | Off | The user reads the exact script and approves it; macOS permissions still apply |

## What an agent never gets

- The contents of password fields and payment fields.
- Pages in a private window. Private windows are left out of agent context, tab groups and the omnibox.
- A password, payment or verification-code page. On such a page the task gives the tab back to the user.
- Saved passwords. They are in the macOS Keychain behind device authentication, and Serein never submits a sign-in form on its own.
- A credential of an agent provider. Each agent tool signs in by itself. Serein never types, stores or reads such a credential.
- A file download. Agent tabs cannot download.

## How a task is kept apart

- **Its own capability.** Each task reaches the browser through a short-lived capability over a private Unix socket. Stop revokes it immediately.
- **Its own process group.** Up to three tasks run at the same time. Stop ends only the task that it belongs to.
- **Its own cookies.** Agent tabs use a cookie store that is separate from the user's. A task can open at most 12 tabs.
- **Visible tabs.** Web tasks run in tabs that the user can see. Take Over makes an agent tab the user's own.
- **Untrusted input.** Serein treats page content, imported files and project files as untrusted input. Page text reaches the agent marked as untrusted.

## Limits on the agent tool itself

Serein offers an agent tool for a task only when it can enforce the limits of that task on the tool: the browser only through the task's own tools, the tool's own MCP servers, plugins and hooks kept out, the tool's own web tools turned off, and the file and shell limits of the task. A tool that Serein cannot limit stays in the list, with the reason, and is not offered.

There are four access levels: Supervised (the default), Auto-accept edits, Auto and Full access. Full access needs edits granted and a confirmation the first time in each project.

Serein never asks for Full Disk Access, because the agent tools that it starts would get it too. For each Claude Code run, Serein adds rules that deny reading of mail, messages, browser profiles and cookies, `~/.ssh` and keychains.

## File edits

Before each turn, Serein makes a snapshot of the project in a private Git ref. After the turn, the user sees the diff and can undo or redo the turn. Serein refuses an undo that would conflict with later changes.

Sources: https://serein.pro/security and https://serein.pro/privacy. More: https://serein.pro/llms/faq.md, https://serein.pro/llms.txt