Delta is in early access and does not yet have the agent safeguards described below. Use Delta with care. Early-access use is at your own risk and subject to Delta’s Early Access Agreement.
Agent permissions
Delta’s own agent does not have a permission system. Based on your instructions, it acts autonomously and does not ask before calling tools. This includes potentially destructive calls.
Claude Agent uses Claude’s own permission prompts, depending on its mode. Delta shows each request to the participant whose computer runs the turn and never approves one automatically. If you choose an option to always allow an action, Claude stops asking for it.
Agent sandboxing
Delta does not sandbox agents. An agent has unrestricted access to the device where it runs.
Delta worktree trust
Delta does not ask you to review settings or configuration in a shared repository or Delta worktree before loading them. Code in the repository can run automatically:
- An executable
.agents/preparescript, or its.delta/prepareoverride, runs when Delta first mounts a managed checkout. Adopted existing checkouts are skipped. - On macOS and Linux, an
.envrcthat applies to the checkout runs throughdirenvwhen an interactive terminal or an agent command starts, and Delta allows it ifdirenvhas not seen it before. - Rules files such as
AGENTS.mdand skills under.agents/skills/or.delta/skills/become instructions to the agent.
Review these files before working in a repository you do not trust. See Terminals and Delta Worktrees.
Planned safeguards
Agent permissions, sandboxing, and Delta worktree trust controls are on the roadmap. We will update this page as they ship.