Record and Enforce
Each key has a level. Change it under Gateway → Settings → Keys; the change reaches the gateway within 5 minutes.
- Record: everything is recorded. File changes outside the plan are marked and allowed. Commands and other tools are not compared.
- Enforce: actions outside the plan are refused before they run, and so is any action taken with no plan. Claude is told why.
Enforce is not a sandbox. A command in the plan can still change files that are not in it, and reading a file is checked by tool, not by path.