# What a panel can't do

A panel is a web page with a narrow way out. It can't:

- **Load anything from outside its folder.** Other files, `..` and symlinks out of it are all
  refused.
- **Reach the network.** No `fetch`, images or scripts from elsewhere, unless `csp` names the
  origin.
- **Run tools before you approve them, or run anything `panel.json` doesn't declare.**
  A native permission window appears before the panel loads. New calls require `offsider open`
  to be running. Already-started processes may finish independently.
- **Open anything but a web or mail link.**
- **Get at Offsider's messaging directly.** The app runs in a sandboxed frame, and only the page that
  hosts it can talk to Offsider.

## Where approvals live

Offsider stores remembered decisions in the macOS Data Protection Keychain, scoped to the
signed host app's application identifier. The panel's HTML, JavaScript, manifest, and the CLI
cannot read or write that Keychain group. There is no approval command in the JavaScript bridge
or socket protocol, and no approval file inside the panel folder. Keychain failures block opening
rather than silently granting permission.

Ad-hoc development builds have no provisioned app identity and keep decisions only in host
memory until quit. Their permission window explicitly says approval is for this session.

## What approval means

Approval grants the reviewed commands your normal user privileges. It is not a sandbox for
those commands: they may read credentials, modify files, access the network, invoke other
programs, or interpret the JSON they receive. Executable and explicit file-argument fingerprints
catch changes between opening and invocation, but do not pin every library, imported file,
child command, or environment setting a program may use. File checks are not a defense against
an unrelated malicious process racing file changes or controlling your account.

The sandboxed panel cannot tamper with saved approval. You still need to trust the tools you
approve. Use **Forget Panel Approvals…** in Offsider's menu to revoke them and close panels;
already-started commands may finish.