Grux asks for a lot, because it does a lot. Every one of these is optional, every one is requested only when you first use the feature that needs it, and refusing one disables exactly that feature and nothing else.
Nine permissions, and only five are required by anything at all. The other four are asked for by a feature that still works without them, just with less in it.
| Permission | Required by | What refusing costs you |
|---|---|---|
| Microphone | Meetings | Voice input in Chat and Reactor |
| System audio capture | Meetings | Nothing else. This is the other half of the call, not your mic |
| Screen Recording | Focus log | Screen context in Chat |
| Calendar | Calendar | The agenda on Today, calendar tools in Chat and Reactor |
| Contacts | Contacts | Contact lookup in Chat |
| Automation | Nothing | Commands, and app control from Chat |
| Accessibility | Nothing | Window and selection awareness in Chat, and detail in Focus log |
| Notifications | Nothing | Alerts from Schedules, Workflows and Focus log |
| Full Disk Access | Nothing | Jax Command, one BETA surface, and nothing else anywhere |
That table is not typed by hand. PermissionTableTests parses it out of this file and asserts both columns against the same FeatureRegistry the app reads at runtime: the middle column must name exactly the features that list the permission as required, and the right column must name exactly the features that list it as optional. Move one without the other and the suite goes red.
Grux is not sandboxed. ScreenCaptureKit, AppleEvents and cross app microphone access are not available inside the App Sandbox, so the OS level path allowlist is not available either. The filesystem boundary is therefore enforced in Swift, in one file, and that file is the only path from the model to your disk. It carries a read only root allowlist, a denylist covering .ssh, .aws, .env, the Keychain, Mail, Messages and browser profiles, a size cap, a rate limit, a secret pattern scan on everything it returns, and an audit log. That trade is written up in full in SECURITY.md, including the parts it does not defend against.