Two rules cover most of it. An agent only sees the folder you opened. And it asks before it changes anything real.
Every agent MoveMyCode runs has its own permission prompt: a line in the terminal that says what it wants to do and waits for a yes or no. MoveMyCode watches for that line and raises it as an amber Needs your OK card on the pane and next to the session in the sidebar. The point of the card is that you see it from another pane, or from across the room, instead of finding a stalled agent an hour later.
Answer in the pane, the way the agent asks. Usually that is a key press: yes, no, or "yes and do not ask again for this kind of thing". The card clears when the agent moves on.
The folder you opened, and nothing above it. MoveMyCode starts each agent inside that folder and refuses to open files outside it, including through links that point out. Your other projects, your Documents folder and your home folder are not on the table unless you open them as a project on purpose.
Agents can still reach the network, because that is how they talk to their model. Some can browse the web if you ask. That traffic is between the agent and its provider; MoveMyCode does not add to it or read it.
Files inside the folder, once you say yes. Each agent decides what counts as "needs asking". Claude Code, for example, asks before writing a file, running a shell command or deleting anything, and lets you widen or narrow that in its own settings. Codex and the others have their own equivalents. MoveMyCode does not override any of them.
When MoveMyCode itself deletes something on your behalf, in the file tree or the library, it goes to the Windows Recycle Bin. You can get it back.
Saying no is cheap. The agent stays where it is and waits for a better instruction.
Permission prompts cut the risk; they do not remove it. A fast "yes" to the wrong thing still lands. Work in a git repository, or on a copy, and commit before you hand an agent a wide job. The Recycle Bin catches deletions, not overwrites.