The AI can see. It can talk.
But it can't touch.
AICode runs on a strict privilege model by design. Every native capability is explicit, sandboxed, and reversible. Nothing happens behind your back.
Outside the project
No file access outside the project root. .gitignore and .aicodeignore entries are structurally excluded.
Disk writes
Cannot write a single character to any file. The AI has no write access whatsoever.
Git writes
No commits, no staging, no write commands of any kind.
Shell execution
No commands executed silently. Not even ls.
Inside the project
Full read access to project files, respecting all ignore rules. The AI sees your code, nothing more.
Patch proposals
Every change lands as a reviewable diff. You accept file by file, line by line. You decide what gets applied.
Git read-only
Full history navigation and regression tracing. The AI reads your repository but it cannot touch it.
Shell proposals
ls is a native tool in AICode, not a shell command. Dangerous commands are suggested for you to copy and run. You execute. Not the AI.