Skip to main content
Version: v2.0

Control what an agent can do

Permissions decide which tool calls an agent can make on its own and which need your approval. Set a default on the agent, override it for individual tools, and approve calls while the agent runs. For the underlying model, see Permissions.

Permissions are set on the agent and on each tool​

The agent's policy covers every tool at once. It lives in the Advanced dialog and it is the baseline.

A tool's own permission covers one action and overrides the policy. It lives in the tool's detail dialog. Use it to allow or deny one action while everything else follows the policy.

Set the agent's default policy​

  1. In the playground, set Playground mode to Build.
  2. In the Configuration column, click Advanced.
  3. Open the Permissions section.
  4. Pick a Policy, then click Save.
PolicyWhat it does
Allow readsReads run, writes ask. This is the default.
Allow allEvery tool runs without asking.
AskA human approves every tool call.
Deny allEvery tool call is refused.

Under Allow reads, a connected-app action counts as a read when it has the READ-ONLY badge in the Add app tools dialog. Any action without that badge asks for approval.

Override the permission for one tool​

  1. In the Configuration column, open Tools.
  2. Click the tool's row.
  3. In the TOOL DETAILS pane, set Permission, then click Save.
PermissionWhat it does
InheritFollows the agent's Policy. This is the default.
AllowThis tool runs without asking, whatever the policy says.
AskThis tool always waits for approval, whatever the policy says.
DenyThis tool is always refused.

Permission is available on connected-app tools under CONNECTED APPS and tools you write with Tool definition.

Built-in tools have no per-tool permission. The agent's Policy governs them. Clicking one opens a read-only view with the subtitle Provider built-in tool.

Which setting wins​

When the agent calls a tool, the first of these that applies decides:

  1. The tool's own Permission, when it is anything other than Inherit.
  2. An entry in Auto-approve.
  3. The agent's Policy.

Approve or deny a call while the agent runs​

When a tool needs approval, the run pauses. The conversation shows a card titled Approval needed to continue. The status reads Waiting for your input, and the tool's row reads Awaiting approval.

  • Expand Details to read the arguments the agent wants to pass, as JSON.
  • Click Approve to continue the run. Click Deny to block the action.
  • Anything you type while the card is open is queued until you answer.

Limit what the sandbox can touch​

The Execution environment section of the Advanced dialog sets where tools and code run.

Sandbox has two options. With Local, that is the only field. With Daytona, three more appear:

FieldOptions
Network egressAllow all egress, Block all egress, Allowlist (CIDR ranges). The allowlist option reveals an Allowlist textarea for the ranges you permit, such as 10.0.0.0/8.
FilesystemRead / write, Read-only, No access.
EnforcementStrict (fail if unenforceable), Best effort.

Next​