Access
GitHub
Runtime
The agent will not change anything
Check, in order:- Mode. Ask and Plan withhold the mutating tools. Switch the turn to Agent.
- In the CLI, the sandbox.
--sandbox read-onlyblocks all writes;workspace-writeconfines them to the project. See Modes and permissions. - In the CLI, Spec mode. Mutating tools stay locked until you accept the plan.
- In the CLI, the
permissiontable inconfig.tomlcan denyeditor specific commands outright.cortex debug config --diffshows what differs from the defaults.
Cortex Security
Errors
Every failure is a problem document with a stablecode and a request_id. Common ones in Code:
Full list: Problem catalog.

