The permissions is quite well defined, by default it will ask you for your approval before every cli command that it will run