# Understand sandboxing and permissions

Grant the access required by the feature you intend to use. A search folder, an operating-system permission and a paid plan are different boundaries.

## Feature access

| Feature | Relevant access |
| --- | --- |
| Global keyboard control | Input Monitoring. |
| Window control or text insertion | Accessibility. |
| Audio note recording | Microphone. |
| Voice dictation | Microphone and Speech Recognition. |
| Local file search | Search locations configured in Ouros. |
| Hosted products | Valid sign-in and the applicable product access. |

Manage macOS permissions under System Settings → Privacy & Security. If you deny optional access, use the available typed or local workflow instead of changing unrelated permissions.

## Search locations do not sandbox the shell

Adding a folder controls what Ouros searches. It does not limit every file that a shell command can read or change. Commands run as your local shell with its applicable user and operating-system access. Review commands, paths and arguments before Return.

Do not treat a window containing a terminal as evidence of a separate protected environment. A sandbox claim needs an actual enforced policy for that execution path.

## Diagnose the actual boundary

An account sign-in error needs account recovery, not Accessibility. A missing paid plan is not fixed by Microphone access. A filesystem error needs a check of the destination and permissions. Preserve the draft and exact error while resolving the specific failure.

See [shared privacy guidance](/docs/shared/privacy) and [your first command](/docs/terminals-and-files/first-command).