General & Safety Settings

General settings configure system-wide behavioral instructions, file protection boundaries, and execution approval requirements across your environments.

The Safety Model

Because Orbicus runs on your machine with your user privileges to read project files and run shell commands, it relies on a layered defense model to protect your environment from accidental modifications or harmful commands.

Incoming Request  ──►  Protected Path Check  ──►  Autonomy Policy  ──►  Execution
                             │                          │
                             ▼ Blocked                  ▼ Awaiting Approval

1. Protected Paths: Requests attempting to read or overwrite blacklisted paths are rejected immediately.
2. Approval Policies: Operations requiring confirmation prompt you for explicit authorization before executing.
3. Execution: Confirmed safe operations run within the bounded workspace directory.

Persistent System Instructions

System instructions let you define persistent engineering rules that apply automatically to every conversation and task:

• Style & Language: "Use TypeScript strict mode. Never use any."
• Architecture: "Follow a hexagonal architecture pattern. Keep domain logic decoupled from database drivers."
• Testing: "Always execute existing unit test suites after making code modifications."

These rules remain active across all workspaces unless overridden by project-specific skill definitions.

Protecting Sensitive Paths

Orbicus includes default protections for standard secret and credential files. You can customize this list with glob patterns to prevent the agent from inspecting or modifying sensitive data:

.env*
**/*.pem
**/*.key
**/secrets.json
**/credentials.yml

When a path matches any protected pattern, Orbicus blocks tool access and alerts you in the step log.

Autonomy Modes

You can tailor the balance between unattended speed and manual control: