Consent and privacy

Capture consent controls which local data the Learning Agent reads and sends. It does not grant permission to execute commands. Claude Code and Codex keep responsibility for tool execution. Agent 0.4.4 applies the same capture rules on Windows, macOS, and Linux.

Default policy

The agent allows capture when the rules file is absent or no rule matches. This default keeps a new installation ready to use.

Decision	Effect
Allow	Allows capture and shipment for the matched path.
Deny	Stops capture or shipment for the matched path.
Ask	Keeps the decision pending until you add another rule.
Unreadable ledger	Stops capture and shipment until you repair the ledger.

The local ledger is ~/.itera-learning/consent.rules. The last matching rule wins. The capture hook checks consent before it writes the spool. The shipper checks consent again immediately before transmission.

Use the monitor

itera-learning monitor

Open http://127.0.0.1:5173/#consent. The monitor is a local web app bound to 127.0.0.1. It needs no checkout, Vite process, backend login, or public server.

The Consent tab shows rules, pending paths, source sessions, the destination, and a post-redaction preview. Allow, Deny, and Ask append decisions to the same local ledger as the CLI. The monitor does not send capture data while it displays this information. Agent 0.4.4 does not rebuild transcripts or diffs for acknowledged episodes. Large retained histories do not block the Consent preview.

Use the CLI

List the current rules:

itera-learning consent list

Add rules for the folders that you choose:

itera-learning consent ask "$HOME/itera-review/**"
itera-learning consent deny "$HOME/itera-private/**"
itera-learning consent allow "$HOME/itera-public/**"

Quote each pattern so the shell does not expand it. Rule patterns stay local, but they can reveal project names on your screen.

On Windows PowerShell, you can use native Windows paths:

itera-learning consent ask 'C:\Users\you\itera-review\**'
itera-learning consent deny 'C:\Users\you\itera-private\**'
itera-learning consent allow 'C:\Users\you\itera-public\**'
itera-learning consent list

The ledger stores canonical lowercase paths, such as c:/users/you/itera-public/**. UNC paths use the same form, such as //server/share/project/**.

Run the private self-test:

itera-learning consent verify

On macOS and Linux, require CONSENT_CLI_OK rules=3 mode=0600 scope=capture. On Windows, require CONSENT_CLI_OK rules=3 protection=windows-acl scope=capture. The command uses a disposable private ledger. It does not change your real rules.

What can leave the machine?

The agent can send prompts, final assistant text, tool calls, session metadata, and a bounded working-tree diff. Captured data passes through the shared redaction filter. Redaction is best effort and cannot guarantee removal of every secret.

Normal shipment uses api.iterahq.dev for login and engine.iterahq.dev for capture. The local monitor makes no external requests. Its Activity view and payload preview can show private content.

State files use mode 0600 on macOS and Linux. Private directories use mode 0700 on macOS and Linux. On Windows, the agent reports native access protection as windows-acl and validates the ledger file identity.

Stop capture

Remove an integration while its client is closed:

itera-learning uninstall claude-code
itera-learning uninstall codex

This preserves local history and server-held data. Continue with machine verification.