Trust & Permissions
Nodes that touch your files, your network, or your hardware stay switched off until you trust the project.
A .dna project can contain nodes that read and write files, reach out over the network, or load audio plugins. A project sent to you by someone else is, until you decide otherwise, a file from the internet, and it is treated as one.
Opening a project
A project file opens Restricted unless you have trusted that exact file before. Trust is not inferred from where the file came from or from the fact that you saved it: reopening your own project asks again, once, until you grant it. A file carrying a download quarantine mark opens Restricted whatever you decided previously.
A new graph you have not saved yet, and the built-in examples, are not opened from a file at all, so nothing restricts them.
Restricted does not stop the project loading. The graph opens and can be inspected and edited; only the nodes needing a listed ability refuse to cook, each marked with a padlock on its title bar. A banner across the top reads:
"⚠ This project is Restricted. Capability-bearing nodes are disabled."
It carries three buttons: Trust this project, Review nodes, which selects every capability-bearing node on the canvas so you can read them before deciding, and a × that dismisses the banner without granting anything.
The trust prompt
The prompt lists the abilities this project's nodes need, under This project will be able to:
Scripting runs code from a scripting node or a custom shader.
File I/O reads and writes files on your computer.
Web Fetch downloads data over HTTP and HTTPS.
Plugin Host loads and runs native audio plugins (VST, AU, CLAP).
Network Camera connects to networked IP cameras.
NDI sends and receives video over your local network.
OSC sends and receives OSC messages.
WebSocket opens outbound WebSocket connections.
Serial reads and writes hardware serial ports.
Only the abilities this particular project uses are listed. Trust this project grants them; Cancel leaves the project restricted.
The list is what the project uses today, not the limit of what it is granted. Trust is one switch for the whole file: every ability above becomes available, including to a node added later. A project where nothing was detected says so and still grants the lot.
What the restriction buys
A .dna file can be built to misbehave the moment it runs, reading files, phoning out over the network, or loading a plugin you did not choose. Holding those abilities back until the project is trusted means opening a shared file cannot on its own do any of it.
What it does not buy is a sandbox afterwards. One guardrail runs in both modes: a path containing a .. component is rejected before it reaches the filesystem, trusted or not. Beyond that, a trusted project's file and network nodes have the reach your user account has. Confining writes to the project's own folder is not implemented yet.
Native audio plugins are scanned from the system plug-in folders (~/Library/Audio/Plug-Ins/VST3 and CLAP, and their /Library equivalents), not from the project. Node plugins come from ~/.dna/plugins/ and any folders you add; a folder you added that carries a download quarantine mark is skipped at startup.
Changing your mind
Trust is remembered against the project's file path, so moving or renaming the file asks again. The trusted-projects list in Preferences is where a decision is reviewed or undone. Revoking takes effect the next time that project loads; a project already open keeps the trust it was given for the session.
An unsaved project can be trusted for the session only. Nothing is written down until the project has a file to remember.