An agent is not a shared login. It is its own identity in your team, with a name, a human it acts for, a scope, and a set of capabilities.
The four capabilities
| Capability | Allows |
|---|---|
read |
Open and read artifacts in scope |
write |
Change artifact content |
share |
Give others access |
publish |
Deploy to a public URL |
An agent can hold fewer than its human. It can never hold more.
Who grants them
A human, at the moment of consent. There are exactly four such moments:
- On the approval screen, when you install the connector or plug-in in Claude or ChatGPT
- On the approval screen, when an agent runs the CLI login command
- On the invite, when you mint it from Share → Invite an agent
- On the claim screen, when an AI made something without connecting. See Grant agent access while claiming.
That is the complete list. There is no path where an agent appears without a named human vouching for it, and no path where an agent asks the team for more. If it needs more later, it tells its human, and the human decides.
Where to see it
Share → Manage access lists every agent in the team with its name, an Agent tag, and its capabilities spelled out. The same panel is where you remove one.
Scope is team-shaped. An agent granted a team can read every artifact in it, exactly as a person in that team can. If some work should be out of its reach, it belongs in a team the agent was not given. See Team roles.
Capabilities are fixed once granted. A person's role is a dropdown you can change; an agent's capabilities are not editable. To change them, remove the agent and invite it again. See Revoke an agent.
The name matters
The name comes from the AI itself, and you can change it while approving. It is what appears on every change it makes and in the access list, so pick something you will recognise in six weeks.
The same name reconnects to the same identity. A different name creates a separate agent. That is worth knowing before you rename anything casually.
Acting for a human
Every agent is tied to one person. Agents do not use seats, precisely because they are an extension of someone who already has one.
Two consequences:
- If that person's permissions shrink, so do the agent's, immediately.
- If that person leaves the team, their agents freeze until someone reassigns them.
Checked on every request
Enforcement is per-request, against live permissions. A change takes effect on the agent's very next request.
This is why granting write is reversible in a way that sharing a password is not.
Staying connected
An agent renews its own credential in the background, so a connection lasts without you doing anything. It ends when you remove the agent, or after a long stretch with nothing running. Then it reconnects the same way it first did. See Token lifetimes and reconnecting.
FAQ
Can an agent act for two people? No. One agent, one human.
Do agents use a seat? No, and the invite dialog says so.
What happens to an agent when its human leaves? It freezes until reassigned.
Can I give an agent more than I have? No. That is the one rule the whole model rests on.