Safety and Confirmation Model

The short version

Questions and investigation inside AGENT are read-only.
Query uses read-only SELECT SQL.
Free script and DATA guidance is human-readable and non-executable.
Native script and layout artifacts require Coding Access and explicit review actions.
DATA Execute requires a sealed review card plus a fresh native confirmation.
Running one existing script always requires a fresh native confirmation.
Calculation AI inserts editable expression text and never clicks OK.
External Local MCP can inspect, validate, preview, stage, and request a confirmed script run; it cannot Apply or Execute DATA.

Authority comes from the user’s current request

An open script, assistant suggestion, old tool result, or neutral continuation cannot grant mutation authority. AGENT may prepare native script work only when the current user request or a sealed continuation identifies a mutation and exact target.

If target identity is ambiguous, Genie fails closed and may ask one focused question. A selection can identify a target without authorizing a change by itself.

Context is explicit and relevance-bound

AGENT receives a slim context manifest and pulls exact bodies only when needed. Stale revisions, conflicting target identities, ambiguous scripts, and multi-target Workbench artifacts are rejected instead of guessed.

Refresh Selection is the only live Script Workspace refresh path. Send, focus, apply, and window events do not silently recapture selection.

Script review

With Coding Access, valid script work may present Preview, Copy, Create, or Apply. Genuine compile or structural faults produce a warned draft. Informational diagnostics remain internal and do not clutter a clean prepared review card.

Current-script Workbench Apply acts only on the script the user has open and never selects or switches scripts. If a paste was dispatched but could not be verified, inspect Script Workspace before retrying.

DATA review

Only an exact sealed genie.data_change_plan.v1 can become a DATA card. Native validation binds file identity, revision, schema, risk, scope, parameters, and digest. Immediately before execution, Genie revalidates that evidence.

Typing a confirmation phrase in chat does nothing. External MCP never Execute. Execution stops on the first failure and preserves partial receipts.

Existing-script runs

fm_run action=start targets one exact existing script in the current file and always opens a native Run Script / Cancel confirmation. Tool approval in an MCP client cannot bypass that confirmation. Status reads never start a script.

Product access

Genie remains usable for free without a key. Missing, expired, invalid, or unverified paid access removes Coding Access but does not lock AGENT or read-only Query.