> ## Documentation Index
> Fetch the complete documentation index at: https://namespace.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Levels

Each runner profile can declare an **Access Level** that controls which Namespace
features the runner workload is allowed to use at runtime. Access levels apply
on top of any explicit [workload permissions](/docs/workspaces/access#workload-access) configured on the workspace, and
let you tighten what a particular runner can do without changing your workspace
defaults.

Access Level is a profile-only setting and is configured in the
[runner profile editor](https://cloud.namespace.so/workspace/actions/profiles)
under `Advanced Settings`.

Three levels are available:

* **Permissive** (default): the runner workload uses the workspace's standard
  Namespace permissions. This is the historical behavior and the right choice
  for most profiles.
* **Limited**: the runner workload is restricted to the features needed by
  GitHub Actions jobs, including remote builders, the container registry, the
  cache service, and federated tokens. Other Namespace APIs are not reachable
  from the runner.
* **Restricted**: Namespace feature access is disabled for the runner
  workload. Use this for jobs that should not be able to call any Namespace
  APIs from inside the runner (for example, when running fully untrusted
  third-party code).

If no access level is selected, profiles default to **Permissive**.

## Next steps

* [Runner Controls overview](/docs/solutions/github-actions/runner-controls)
* [Running jobs in containers](/docs/solutions/github-actions/runner-controls/containerized-jobs)