Understand sandboxing and permissions
Grant the access required by the feature you intend to use. A search folder, an operating-system permission and a paid plan are different boundaries.
Feature access
| Feature | Relevant access |
|---|---|
| Global keyboard control | Input Monitoring. |
| Window control or text insertion | Accessibility. |
| Audio note recording | Microphone. |
| Voice dictation | Microphone and Speech Recognition. |
| Local file search | Search locations configured in Ouros. |
| Hosted products | Valid sign-in and the applicable product access. |
Manage macOS permissions under System Settings → Privacy & Security. If you deny optional access, use the available typed or local workflow instead of changing unrelated permissions.
Search locations do not sandbox the shell
Adding a folder controls what Ouros searches. It does not limit every file that a shell command can read or change. Commands run as your local shell with its applicable user and operating-system access. Review commands, paths and arguments before Return.
Do not treat a window containing a terminal as evidence of a separate protected environment. A sandbox claim needs an actual enforced policy for that execution path.
Diagnose the actual boundary
An account sign-in error needs account recovery, not Accessibility. A missing paid plan is not fixed by Microphone access. A filesystem error needs a check of the destination and permissions. Preserve the draft and exact error while resolving the specific failure.