Agent permissions and tools
Found this helpful? Share it:
Found this helpful? Share it:
Permissions decide what an agent can reach and do. Start with a ready-made access preset, layer on the autonomy dial for how much it does on its own, and approve or deny individual actions as they come up 🔒
The main control on the agent edit page is an access preset. Each preset is a ready-made set of tool and resource permissions, so you set an agent up without configuring every capability by hand:
Full Access: the agent can use every tool.
Assisted: every tool is available, and high-impact calls are flagged for your review.
Standard: the agent can read and write core resources, like files, chats, and computers, and search the web.
Read Only: the agent can read resources but not change anything.
Match the preset to the job. A "Writing Coach" is happy on Read Only or Standard, while an agent that deploys code needs more reach.
A preset decides what an agent is allowed to touch. The autonomy dial decides how much it does before it stops to check with you, from read-only up to full autonomy. The two work together: the preset is the outer limit, and the dial controls the pace inside it.
Set a default on the agent, and change it per chat at any time. See Autonomy and confirmations.
When the dial asks the agent to check in, the action pauses right in the chat. You see the tool call it wants to make with Allow once and Deny buttons, plus a compact banner above the composer when several are waiting.
Approvals are yours alone: an agent can never approve its own pending action. Pressing Stop cancels everything still waiting.
Autonomy and confirmations are about oversight: how often the agent checks in. Permissions are the actual boundary of what it can reach, and they hold even when the dial is set to full autonomy.
Two rules keep that boundary honest in a shared workspace:
An agent's reach is intersected with your own workspace membership. It can never do something in a workspace that you could not do there yourself.
When an agent hands work to a sub-agent, it can never grant the helper more than it has. Reach only ever narrows down the chain, never widens.
Be careful with write access and computer access. These let an agent make changes that can be hard to reverse. Give an agent only the reach the task needs.
To hand an agent a password or API token without putting it in the system prompt, store it as a credential and reference it by name. See Credentials.
Related articles
Agents
Create AI personas with custom instructions, their own memory, and their own default model.
Autonomy and confirmations
Decide how much an agent can do on its own, approve or deny individual actions, and stop a run at any time.
Credentials
Store API keys and app connections once, then let your commands, functions, and agents use them without pasting a key into a chat.
Was this helpful?