Agent permissions

Control what custom agents can access and do with the right permissions.

Agent permissions should follow the same principle as user permissions: grant only what is needed.

Scope access tightly

Limit the models, boards, databases, or teamspaces an agent can use. This reduces risk and makes its answers more predictable.

Keep user and agent permissions aligned

An agent should not become a shortcut around normal governance. If a user would not be allowed to see or change something directly, the agent should not expose it for them either.

Review permissions after each expansion

Any time you widen an agent’s scope, review what new content, actions, and side effects that change introduces.