What agents may do

Each server says what agents may do with its tools: call them straight away, ask the person first, or not call them at all. You set it once per server, and it holds for every client that connects.

Set it for each kind of tool

On the server's Settings tab, the What agents may do card has a row for each kind of tool, from its risk:

• Read: tools that only look things up.
• Write: tools that change things in your API.
• Delete: tools that remove things.
• Outside the API: tools that act beyond it, like sending an email or taking a payment.

Each row is one of three levels:

• Allowed: agents call it without asking.
• Ask first: the call waits for a yes from the person the agent acts for.
• Off: agents can't call it. It isn't listed to them, and it's refused if they try anyway.

A new server starts with Read allowed, Write and Outside the API on Ask first, and Delete off. Changes reach agents from their next call.

Set an area or a tool apart

An area is a group of tools: a tool's area is its first tag. Where an area or one tool needs to differ from its kind, set it apart.

Choose Set areas and tools apart on the card. The page lists every area with what its tools may do. Open one to see its tools, or use Find a tool or area, the Kind filter, and Only what's set apart. Pick a level from an area's or a tool's menu to set it apart, and choose As its kinds, or As its area and kind for a tool, to put it back.

A tool's own level comes first, then its area's, then its kind's. You can set up to 200 areas and 500 tools apart, 50 at a time. Tools can be set apart once the server has a live deploy.

Who gets asked

Ask first asks the person the agent acts for. That's never you, unless it's your own agent:

• On a server only your team connects to, that's the teammate who connected the agent, signed in to Sokie.
• On a server open to its API's users, it's that user, on their own page, after signing in to your API again. Nobody on your team approves their calls.

When the client can ask, the question shows in the client itself. Otherwise the agent shows a link, and the page it opens says what the agent wants to do, with its arguments if you open them. Choose Allow once or Refuse. A tool that deletes or acts outside the API is always answered on that page, never in the client.

Once the person says yes, the agent makes the same call again, with the same arguments, and it runs once. A refused call tells the agent nothing ran.

How long a call waits

A call that asks first waits 10 minutes for an answer. With no answer by then, the agent is told no, and it can ask again. After a yes, the agent's same call runs once within 10 minutes.

Public servers

A public server has nobody to ask. There, Ask first acts as Off, and the card says so. Read and anything else you set to Allowed still run.

What a person connecting can choose

When someone connects their agent, they choose what it may do: everything the server allows, or Read only. They can choose less for their own agent, never more. With Read only, every tool that isn't Read is off for that agent.

Who can change it

Owners, admins and members can change what agents may do. Letting agents delete or act outside the API without asking is for owners and admins only: a member can't set Delete or Outside the API to Allowed, set an area to Allowed, or allow a tool of those kinds. An API key can't change it at all.

Every change is in Audit. Sign-in and security shows what agents may do on every server, side by side.

Servers from before

A server made before you could choose lets agents call every tool without asking. Its card says so, with Read freely, ask before the rest, which sets Read to allowed and the other kinds to Ask first, or Keep it as it is.

A server whose live deploy runs on an older runtime doesn't hold agents to this until it's redeployed: the card says so. Redeploy without new code has how.