Read a UTF-8 text file from the data directory. (Risk: LOW)

Write content to a file in the data directory. (Risk: MEDIUM)

Modifies data; requires human approval unless policy allows it.

Delete a file from the data directory. (Risk: HIGH)

Destructive; requires explicit human approval.

Execute a system command (SIMULATED). (Risk: CRITICAL)

Denied by default. Never runs a real subprocess.

Approve and execute a pending ask operation.

This is the ONLY way an ask operation runs. The token must have been issued by the server for the exact operation being approved; it is single-use and expires. Intended to be called on behalf of an explicit human approval action, not autonomously by an LLM.