The Athena Guide · 12

Permissions and security

When Athena asks for confirmation, what stays on your PC, untrusted content

The three modes

Chosen on the arcs of the ring in the chat (the names can be changed in Settings → Permissions). Each chat remembers its own: if you set Lore in one chat, the others stay as they are, and you find it the same on the computer and on the phone. In shared chats everyone has their own. New chats start from the mode chosen in Settings → Permissions (Data to begin with).

• Manual (blue): asks for confirmation for everything;
• Data (orange): asks only when there is a risk, that is when something goes out, is deleted or lasts over time;
• Lore (red, with the triangle at the top right): works on its own. What it still asks for you decide in Settings → Permissions → Custom Lore: at the start commands that delete, protected files, after the web or mail network commands, sending and memory, downloading a file from the web, installs (including packages installed with a command, such as pip install or npm install) and Claude or Codex. Full access turns everything off: it never asks, and the risk is yours. Hovering the triangle shows how your Lore is set.

The mode applies to the device where you choose it. If you change it while Athena is answering, it applies at once to the rest of the answer, from the next tool on; confirmations already open stay to be pressed.

What always asks

Everything is set in Settings → Permissions: the names of the modes, Custom Lore, when Athena sends web forms on her own, and the rules that always apply.

Hidden orders in content. Web pages, mail, documents and text in images can contain malicious orders. Athena tries to recognise them and to defend herself, but a model can make mistakes: it is not a guarantee. We recommend letting actions that send information ask for your confirmation after reading the web or mail. In Lore you decide it in "Custom Lore".

Sending an email or a form, protected files (program and system settings), actions after reading untrusted content (the web, mail). In Lore you decide, in «Custom Lore»: at the start, after the web, only commands that could take data out or install something ask (network, downloads, git push, installs), also inside the scripts they run. Private keys, .env files and Athena's data are never touched.

Undo

Before writing a file Athena keeps a copy for 30 days: Undo under an answer brings the files back as they were. Changes made by commands cannot be undone.

Untrusted content

A web page, an email, a sound's transcript, a photo's description or a downloaded document may contain hidden instructions. After reading them Athena asks before acting towards the outside or remembering something (in Lore, for what you left in "Custom Lore"). It is the defence that does not depend on the model: that is why it is worth keeping.

The same goes for agents: an agent started by an email or a webhook stays marked in the following runs too (its memory reaches it as data), and when you make it work from the chat the mark passes to the chat as well.

Where your data is

Conversations, memory, documents and files are on the PC acting as server; the engine that thinks is on your compute server. Each user sees only their own. The server log doesn't keep what you write or say: only how long it is.

Athena opens only internet addresses: never home or service ones (the router, the PC, the compute server), not even if a site tries with a redirect or by changing address at the last moment. Connectors and mailboxes towards home addresses (a service on the local network, a mail bridge on the PC) can be linked only by the administrator.