Permissions
Agent Zero separates three kinds of authority. None of them implies another.
Dashboard sessions
A Better Auth session grants access to the dashboard UI. Registration is closed unless AUTH_ENABLE_SIGNUP is exactly true, so who holds a session is an operator decision.
Control-plane principals
Control-plane mutations require an operator-issued bearer token, with per-principal repository and execution-mode grants:
| Variable | Grants |
|---|---|
AGENT_ZERO_CONTROL_PLANE_TOKENS | Who may mutate at all (name:token pairs) |
AGENT_ZERO_CONTROL_PLANE_REPOSITORIES | Which repository paths tasks.create may target |
AGENT_ZERO_CONTROL_PLANE_MODES | Which execution modes each principal may request |
Without a mode grant, a principal is limited to the non-writable observe and suggest modes. Approval decisions record the authenticated principal's name, never a wire-supplied actor. See Protect endpoints.
Repository policy
What a run may do to a checkout is decided by the target repository's own .agent-zero.yml — mode, autofix gates, change-risk classes, and isolation requirements. A control-plane principal can request a mode, but repository policy still has to allow the work, and high-impact changes always require human approval. See Repository policy and the Safety model.
Organization roles
When organizations are enabled, membership and roles govern what a signed-in user sees and manages inside the dashboard. Organization authority never extends to the control plane or to repository policy.