Elevation
Eddie needs a separate elevated helper process to perform system-level actions: create the VPN tunnel, apply Network Lock firewall rules, change routing tables, and similar tasks. The main UI or CLI stays unprivileged and talks to that helper. For how that channel is restricted, see Details about security of UI versus Elevated.
You can elevate once per run (spot mode: an OS prompt each time) or install a persistent elevated service so Eddie does not ask every launch (Preferences option, or the service=install / service=uninstall commands on the helper binary below).
Windows
Eddie launches Eddie-CLI-Elevated.exe. In spot mode Windows shows a UAC prompt (runas); you need credentials that can approve elevation. Optionally install the Windows service (EddieElevationService) so the helper stays available without a prompt on each start. Example install/uninstall (run from an elevated shell, or accept the UAC prompt when Eddie does it for you):
Eddie-CLI-Elevated.exe service=install Eddie-CLI-Elevated.exe service=uninstall
Linux
Eddie launches eddie-cli-elevated. By default (elevation=auto) it picks a method: if the helper is setuid root or the process is already root, no prompt; for the UI it prefers pkexec; for the CLI it prefers sudo when your user is in the sudo or wheel group, otherwise su, with pkexec as a further fallback. You can force a method, for example:
./eddie-cli elevation=pkexec
Allowed values include auto, none, pkexec, sudo, and su. Another option is a systemd unit (eddie-elevated.service), or marking the helper setuid root (chown root:root and chmod u+s on eddie-cli-elevated). If you use a portable or AppImage build with the service installed, uninstall it before removing the files:
sudo ./eddie-cli-elevated service=install sudo ./eddie-cli-elevated service=uninstall
MacOS
Eddie launches eddie-cli-elevated (inside the app bundle under Contents/MacOS/ when you use the UI package). By default (elevation=auto) it uses no prompt if the helper is setuid root or already root; otherwise the UI uses a MacOS authentication dialog (elevation=ui), and the CLI uses sudo when available. You can force elevation to auto, none, sudo, or ui. Optionally install a Launchd daemon so elevation is not requested every run. Example:
sudo ./eddie-cli-elevated service=install sudo ./eddie-cli-elevated service=uninstall