Loading…
Loading…
Agent permissions
The exact default authority of the agent on each surface, the limits of the protections we ship, the connector scopes actually requested today, and every way to take access back. Some of this is less flattering than a marketing page would write it. That is the point. You cannot review a permission model you have to infer. The rules that govern how you use it are at /acceptable-use.
Managed Cloud · no approval
In Managed Cloud, a turn that offers no connector or MCP tool runs in automatic approval mode. With no saved preference of your own, the built-in tools below execute without a prompt. This is a deliberate design choice: each one acts inside a read-only or isolated boundary, and prompting on every web search would train you to click through prompts that matter. It is stated plainly here rather than implied away.
| Web search | Runs a search and reads the results. Classified as a read that accepts untrusted content and creates an egress path, because a search query is a place secrets can leak and a result page is attacker-influenced text. |
| Fetch a page | Fetches a single URL through an SSRF-guarded path. Same classification as search, for the same reasons. |
| Run code | Executes model-authored code in an isolated cloud sandbox belonging to that conversation, not on your device. Classified as an irreversible execute action that creates an egress path. |
| Write a file, create a folder | Writes inside the conversation’s own sandbox workspace. Not your filesystem, not your cloud storage. A file write is classified as irreversible; a folder create is reversible. |
| Create an Office file | Generates a Word document (.docx) or a PowerPoint deck (.pptx) on our servers and attaches it to the conversation for you to download. Those two formats are the whole of it: no other Office format, and no editing of a file you already have. Reversible, no egress path. |
| Run a skill | Loads a skill’s instructions into the turn. Skills act through the tools above and are gated by them. |
You can still override any of them: set a tool to “Needs approval” or “Blocked” and your setting takes precedence over automatic mode.
Managed Cloud · approval required
When a turn carries any connector or MCP tool, the whole turn switches to manual approval mode. These tools cross an external or mutating boundary, so they are gated by default and on every turn, not once at connect time.
A saved “ask” verdict outranks automatic mode, so you can pull any built-in tool back into the approval flow.
When untrusted content has entered the conversation, a private authenticated source is reachable, and the pending call can move data out of the boundary, an otherwise automatic approval escalates to a human decision. See the limits below.
| 1. Blocked by you | Denied. Nothing overrides this. |
| 2. Allowed by you, escalation triggered | Asks anyway. |
| 3. Allowed by you | Runs. |
| 4. “Needs approval” by you | Asks. |
| 5. Manual mode (a connector tool is in the turn) | Asks. |
| 6. Escalation triggered | Asks. |
| 7. Otherwise | Runs. |
Honest limits
The escalation is a mitigation, not a proof. We publish its gaps because a reviewer will find them anyway, and a mitigation you can reason about is worth more than a clean claim you cannot.
Untrusted content is recognised when a tool fetched it: a web page, a search result, a pull-request diff. Content you paste or attach yourself is not counted, and that is a real injection vector this check does not see.
Whether a sensitive source is reachable is derived from which tools were offered, not from what was actually read. A connector merely being available counts. We would rather cost you a click than miss a case.
Whether a call can move data out is per-tool metadata. An MCP server that phones home during what it declares as a read is not visible to this check, which is exactly why any tool we have not classified is treated as creating an egress path.
The check gates automatic approval only. If it escalates and you approve, the call runs.
Blocking
Blocking a tool is not a client-side preference. The verdict is stored against your account and checked on the server before any side effect, on the streaming tool loop and again when an approval is resumed. A modified client, or a request you write yourself against the API, cannot execute a tool you blocked; the model is told the tool is blocked and instructed not to retry it.
One thing a Block does not do: it does not hide the tool from the model’s list of available tools. The model may still attempt the call. The call is refused before it runs, and nothing happens.
In the browser
The Chrome extension can drive a tab through the Chrome debugger. Starting a session is always an explicit action: you type a goal and click. Once running:
| Ask before acting | On by default. An unset preference means ask; autopilot is an explicit opt-out you have to choose. |
| Unanswered approvals | Denied after 30 seconds. The gate fails closed, not open. |
| Where it can go | Navigation is confined to the site allowlist you maintain in extension options. |
| Text leaving the page | Page-text summaries and field readbacks are redacted by the driver before they leave. |
| Screenshots | Screenshots are not redacted and cannot be. You cannot scrub secrets out of a PNG. They reach the Managed Cloud gateway. If a page has a secret visibly rendered on it, a screenshot of that page carries it. This is a residual, accepted risk, bounded by the allowlist and the approval gate. |
| Where inference happens | Computer use requires Managed Cloud sign-in and calls the Managed Cloud gateway directly from the extension. |
On Desktop
Desktop runs tools on your machine, so it carries its own gate: dangerous tools prompt in manual mode, per-tool approval policies are stored and reapplied, and connector settings expose a standing Always allow / Needs approval / Blocked control for each tool. Desktop is also the only surface today that completes a real OAuth flow. See the next section.
Connectors
The connector directory is larger than what is connectable. This section describes the current state, not the roadmap.
| The GitHub App | Three tools: read a pull-request diff, post an issue or pull-request comment, and post a pull-request review. Access comes from the GitHub App installation you authorize; its permission set is configured on GitHub during install and is shown to you there. We do not restate it here, because it is not declared in our own code and we will not guess at a permission list on your behalf. |
| Operator-configured MCP servers | Remote MCP endpoints configured server-side by AGI. The endpoint and its credentials stay server-side; nothing you supply flows into them. |
| Your own remote MCP servers | A server URL you provide, with an optional bearer token that is encrypted at rest and scoped to your account alone. Its tools are whatever that server advertises at runtime. |
Every other connector in the directory is not connectable on the web today. Attempting to connect one returns an explicit “not implemented” response rather than a fake connected state. No OAuth token for Gmail, Drive, Slack, Notion, or any other branded catalog connector is stored in your AGI account, because no such flow exists on the web. The record we keep for a connector is an enablement flag: a connector id, an auth type, and whether it is active. It holds no tokens and no endpoint URLs.
On Desktop, Gmail and calendar integrations use your own OAuth client credentials with PKCE, and the resulting tokens are encrypted with a key derived from your machine and stored in local SQLite on that device. The provider’s own consent screen shows these scopes when you authorize; we list them here so you see them before you get there.
| Gmail | gmail.readonly (read mail), gmail.send (send mail as you), gmail.modify (change and delete mail, including labels and trash), userinfo.email and userinfo.profile (identify which account you connected). gmail.modify is broader than reading and sending: it permits modifying and deleting messages. |
| Google Calendar | calendar.readonly (read events), calendar.events (read and write events), and auth/calendar: the unrestricted calendar scope, which is broader than the other two and makes them redundant. |
| Outlook Calendar | User.Read (basic profile), Calendars.Read, and Calendars.ReadWrite (read and write your calendars). |
Two of those requests are broader than the feature needs: Gmail’s modify scope and Google Calendar’s unrestricted scope. We are naming them rather than describing the narrower scope we wish we asked for. Narrowing them changes behaviour for existing connections, so it is tracked as engineering work, not a wording change.
AGI does not vet the remote MCP servers you add. The operator of that server sees the conversation context you send to its tools, and any token you enter is transmitted to it. We validate that the URL resolves to a public host (private and link-local addresses are rejected), and we encrypt the token at rest and scope it to your account. That is infrastructure hygiene, not an endorsement of the server. Add servers you trust, the way you would add a dependency.
Revocation
| Disconnect a connector | Removes the connection and also deletes every saved per-tool permission for that connector, so a past “Always allow” cannot survive a reconnect. |
| Reset one tool | Set a single tool back to “Needs approval”, or delete its saved verdict outright. This exists specifically so a one-time “Always allow” is not permanent. |
| Block one tool | A blocked tool is refused server-side before it runs, on the normal tool loop and on the approval-resume path. |
| Unlink GitHub | Disconnecting GitHub deletes your installation records so GitHub tools stop being offered. The GitHub App itself remains installed on your GitHub account until you remove it at github.com/settings/installations. Do both for full revocation. |
| Delete a custom MCP connector | Removes the server and the encrypted bearer token you supplied with it. Rotate that token on the server side too if it was ever sensitive. |
| Browser: remove a site | Take a site off the extension’s allowlist and the browser agent can no longer navigate to it. |
| Browser: re-enable the gate | Turn “ask before acting” back on if you previously opted into autopilot. Only an explicit opt-out disables it. |
| Desktop: per-tool policy | Desktop connector settings carry a standing Always allow / Needs approval / Blocked control per tool. |
On the web today, per-tool permissions are set from the approval card shown in the conversation when a tool asks: that is where Always allow, Needs approval, and Blocked live. A standing per-tool settings panel exists on Desktop. Connecting and disconnecting a connector is recorded in your account’s security audit events.