Reference
Permissions and containers
What notagent's permission rules and hooks can and cannot guarantee, and when to reach for a container.
What the rules cover
notagent’s permission rules and hooks can refuse agent actions. Modes decide whether the agent may modify the workspace at all, and the mode leads the footer’s stats line so it is readable at a glance. A PreToolUse hook can deny a single call, and the approval flow asks before anything a mode does not already permit.
What they are not
They are not an operating-system security boundary. The process still has the permissions of the user that launched it. If you need stronger boundaries, run notagent in a container or sandbox.
Project hooks and trust
Project hook loading is currently independent of project trust. Review .notagent/hooks.json before starting notagent in an unfamiliar checkout, because its commands may run even when that project has not been trusted. See Hooks.