When Oda needs more access

Some steps need more access than the chat's mode allows. DataMind Oda reports the denial, and can ask you to allow a single retry with wider access. This page covers that request and what happens when the limits cannot be set up on your computer. How the modes work, and how to change them, is in Workspaces, files and permissions.

When a step needs more access

A step that tries to change files the mode does not allow is stopped by the file sandbox:

• The step's result carries the notice [sandbox: file access denied under <mode> mode], where <mode> names the mode the step ran under, for example [sandbox: file access denied under read-only mode].
• The denied change is not made. Parts of a command that ran before the denial may have completed, so check anything Oda reports it changed.
• A denial is the limits working as intended, reported as its own outcome, separate from how the step ended. The step also records how completely the limits could be applied on this computer.
• The words in a command's own output come from your operating system, so they differ between systems: for example Operation not permitted on macOS or Read-only file system on Linux.
• Oda reports the denial instead of retrying it quietly. The result adds that the exact same step can be retried once with wider access, and that the approval prompt asks you first. Oda may also continue with the task another way.

The limits cover file changes only; they do not restrict what a command reads, or its network access. Nothing runs before you answer a request. For the step kinds themselves, see Sandboxing and command limits for commands and File safety and error messages for file changes.

Answering the request

A request for more access uses the same card as other approvals:

• The widening covers that one step only. The chat keeps its access mode, and the next step that goes wider asks again.
• A request takes one answer. It can be cancelled, and a late answer is discarded; nothing is approved on your behalf.
• With approval prompts turned off, or if nothing can ask you, the wider retry is refused instead of run. Oda never removes the limits just because it cannot ask: it refuses and says why.
• In a scheduled run, no one is there to answer, so a step that needs your answer does not run, and the run history records that it needed approval. See Schedule recurring tasks.

Your first task lists the choices and what each answer does; Approvals covers the card itself.

How far a retry can widen

A retry can only widen, and only as far as it needs:

• Oda asks for the narrowest wider access that can work, with a one-sentence reason. The approval prompt states the request as escalate sandbox to <mode>: <justification>.
• The ladder is closed. A request that repeats the mode the step ran under needs no approval, and a request for a narrower mode, or one without a reason, is refused before it reaches you.
• A step that stays inside the chat's current mode needs no request; only a widening asks. If you allow it, the result reports the mode the step actually ran under.
• To give Oda wider access for a whole task, change the chat's mode yourself; see Workspaces, files and permissions.

When the limits cannot be set up

On some computers the file limits cannot be applied to your folder, for example when the system refuses the permission change they need, or when nothing on the computer can apply them. Oda does not drop the limits quietly. It names the folder and the reason, for example:

DataMind Oda can't limit writes to <folder> because no sandbox is usable on this computer. Choose a folder you own, or switch to Full access.

When a prompt can reach you, it asks before running that one step without restrictions:

DataMind Oda can't limit writes to <folder>. Run this <subject> without restrictions?

Here <subject> is command for a shell command and operation for a file change.

• If you allow it, exactly that one step runs without restrictions, as it would in Full access; nothing else changes, and the chat keeps its access mode.
• If you decline, the step does not run: Running this <subject> without restrictions was not approved, so it did not run. Oda points to the ways forward: allow it when it retries, switch the chat to Full access where your account offers it, or open a folder you own.
• When nothing can ask you, the step does not run either: No approval prompt is available here, so this <subject> did not run. A cancelled request ends the same way: no answer, no run.

When no limits can run at all

Some setups cannot run the limits at all. Oda will not run the step without them: it explains what is missing, and the step does not run. A folder you own, Full access where it is offered, or another approach can move the task forward.

On Windows

On Windows, a few effects of the limits are worth knowing:

• Some protections are partial: a hard link (a second name for the same file) still counts as the same file, and a limited command is not separated from the app's console.
• In limited modes, some administrative and inventory commands do not work.
• Some commands that start another process through a pipe are blocked.
• PowerShell runs in a restricted language mode under Read Only; under Workspace Write it runs normally.

Questions, answered

What does it mean when Oda asks for more access?

A step tried to go beyond the chat's access mode, for example changing a file outside the workspace or running a command that needs more rights. It was stopped, and Oda can ask to retry that one step with wider access. Nothing runs before you answer.

How much more access can Oda ask for?

Only wider, and only as far as it needs: from Read Only it can ask for Workspace Write or Full access; from Workspace Write, only Full access. A step that stays inside the chat's current mode needs no request.

How long does an allowed retry last?

One step. The widening covers exactly that step, the chat keeps its access mode, and the next step that goes wider asks again.

What happens if I reject the request, or never answer?

The step does not run. A rejection ends it for that step, and instructions you add are passed on so Oda can work another way. If the request is cancelled or nothing can ask you, nothing is approved, and a late answer is discarded.

Why did Oda ask to run a step without restrictions?

On some computers the limits cannot be applied to the folder, for example when the system refuses the permission change they need. Instead of dropping the limits quietly, Oda says so and asks first. If you allow it, that one step runs without restrictions; if you decline, it does not run.

Why can't Oda apply any limits at all?

Some setups cannot run the limits at all. Oda will not run the step without them: it explains what is missing, and the step does not run. A folder you own, Full access where it is offered, or another approach can move the task forward.

What do the limits change on Windows?

Some protections are partial (a hard link still counts as the same file, and a limited command is not separated from the app's console), some administrative and inventory commands do not work in limited modes, some commands that start another process through a pipe are blocked, and PowerShell runs in a restricted language mode under Read Only.

Did the blocked change happen anyway?

No. The denied change is not made. Parts of a command that ran before the denial may have completed, so check anything Oda reports it changed.

Why was a request for wider access refused before it reached me?

A request must name a strictly wider mode and carry a one-sentence reason; a request for a narrower mode, or one without a reason, is refused before it reaches you. When nothing can ask you, the request is refused as well, and the step does not run.

How do I keep commands from being blocked?

Pick the mode that matches the work: Workspace Write for changes inside the workspace, Read Only for look-only tasks. If the files are elsewhere, add that folder as the workspace. Full access removes the limits, but your DataMind OS account must offer it; see Permissions and approvals.

What does a denied step look like in the chat?

The step shows a short note that the change was denied, and the note names the mode the step ran under. The denied change is not made. Oda then either asks to retry once with wider access or continues with the task another way.