> ## Documentation Index
> Fetch the complete documentation index at: https://docs-2.manicule.dev/llms.txt
> Use this file to discover all available pages before exploring further.
> For every page in one file, fetch https://docs-2.manicule.dev/llms-full.txt (large).
> To search and read these docs as tools, connect the MCP server at https://docs-2.manicule.dev/api/mcp.
> Every agent surface: https://docs-2.manicule.dev/.well-known/llms-manifest.json

# Transparency Dock & Approval Gates (/desktop/transparency)

<!-- agent-signals: reading_time_min: 1 · est_tokens: 497 · updated: 2026-11-11 -->
Related: [Desktop Workspace Overview](/desktop/overview.md), [Agentic Canvas Mode](/desktop/agentic-mode.md), [Code Editor & Highlight-to-Ask AI](/desktop/code-editor.md), [Multi-File Visual Diff Viewer](/desktop/diff-viewer.md), [Integrated PTY Terminal](/desktop/terminal.md)

> Granular permission controls, approval gates, and execution safety in BhaiCode Desktop.

BhaiCode Desktop uses the **Transparency Dock** to monitor, intercept, and gate all agent tool calls before execution.

***

## Risk Classification Tiers

```mermaid
graph TD
    OP["Agent Requests Tool Execution"] --> TIER{"Risk Evaluation"}
    TIER -->|Safe / Read-Only| AUTO["Auto-Executed<br/>(File reads, symbol search, git status)"]
    TIER -->|Workspace Edits| STAGE["Staged in Diff Viewer<br/>(Creating files, editing code)"]
    TIER -->|High-Risk / System| GATE["Approval Gate Intercepted<br/>(Terminal commands, package installs, git push)"]
```

### 1. Safe (Read-Only)

* Reading file contents inside the open workspace directory.
* Searching symbols, grepping code, and listing directory contents.
* Inspecting Git status and diffs.
* *Action*: Executed automatically without interrupting your flow.

### 2. Workspace Modifications

* Creating new source files or editing existing files inside the project.
* *Action*: Executed and staged in the [Visual Diff Viewer](/desktop/diff-viewer) for your review.

### 3. High-Risk / System Operations (Gated)

* Running shell commands in the terminal (`npm install`, `docker run`, `rm -rf`).
* Modifying files outside the workspace root.
* Git remote write operations (`git push`).
* *Action*: **Intercepted by the Approval Dock**. The agent pauses until you choose an action.

***

## The Approval Prompt

When a high-risk command is intercepted, the dock displays:

1. **The Exact Command**: Command line, working directory, and environment flags.
2. **The Stated Reason**: Why the agent believes this command is required.
3. **Controls**:
   * **Approve Once**: Allows this specific run.
   * **Always Allow for Session**: Whitelists this command pattern for the duration of the current task.
   * **Deny & Provide Feedback**: Cancels the command and sends your explanation back to the agent so it can find an alternative approach.