---
title: Understand your permissions
description: Choose the intended account, space and access level before connecting an AI client or approving a save.
url: https://docs.thegram.one/guides/permissions/
lang: en
tier: current
editorial_sources:
  - https://thegram.one/install/agents.md
  - https://github.com/thegram-one/thegram-plugin
---

# Understand your permissions

## Check account, space and access

Before connecting, confirm which Thegram account you are using, which vaults or separately connected Drive resources the client can access, and whether it can read or write. A vault grant is not a document-only sandbox.

| Connection | What you control | What it does not imply |
| --- | --- | --- |
| ChatGPT or Claude OAuth | Your provider consent and the intended Thegram resources | Permission to save every conversation or access local-only files |
| Coding-agent API key | Named key, selected resources, read/write scope and expiry | Browser login, key administration or access beyond current membership/policy |
| Google Drive | A separate provider connection and resource grant | Automatic access just because another vault is authorized |

## Read-only setup first

A connection check lists accessible resources and reads an existing document. An empty result can be valid. Never create, overwrite, share or delete a document just to make setup look successful.

## Approve a save separately

Review the content and **exact destination** before writing. A connected account or write-scoped key is technical authority, not permission to copy unrelated private data. After an authorized save, read that exact document back; check retrieval separately because indexing may lag.

## Keep secrets out of chat

Enter a coding-agent API key only at the CLI’s hidden prompt or through your managed secret environment. Do not put it in a chat, source file, command argument, screenshot or shell history. Never use another person’s key to work around a denial.

## Remove access deliberately

Review OAuth agents and API keys in [Thegram Settings](https://vault.thegram.one/v3/settings/agents). Revoke an unwanted key to stop future server access. CLI `disconnect` removes only the saved local credential. Changing Docs or restarting the UI cannot issue a key or expand permissions.

For technical storage boundaries, read [Storage permissions](/reference/storage-permissions/). If access differs from what you expected, use [troubleshooting](/guides/troubleshooting/) rather than switching credentials or destinations.