Chat permissions

Every Chat thread has an access mode:

Mode	Behavior
Read only	Answers and runtime evidence. No governed mutation is exposed or accepted.
Standard	Conversation plus safe, explicitly confirmed actions such as creating a task, retrying a Goal, resuming a checkpoint or re-enabling a provider.
Full Access	All Maestro-governed Chat actions, including cancellation.

Full Access is still not unrestricted computer access. It does not bypass provider authentication, the Git worktree boundary, application commands or operating-system security. Destructive OS actions and arbitrary shell access are outside the Chat contract.

High-impact actions require an explicit action request and are recorded as a system message. If the thread is read-only, the service rejects the mutation even if the model suggests it.