Connecting an AI feels like a big decision, so here is the whole answer in one place.
The one rule everything else follows
An agent can never exceed the human who connected it.
It acts on behalf of one person, with capabilities that person granted, and every single request is checked against that person's live permissions. Not the permissions at consent time. The permissions right now.
If your access changes, your agent's access changes with it, immediately.
What an agent can do
With the capabilities you grant:
| Capability | It can |
|---|---|
read |
Open and read artifacts within its scope |
write |
Change artifact content |
share |
Give others access to an artifact |
publish |
Deploy an artifact to a public URL |
Plus, always: create new artifacts and list what it can read.
What an agent cannot do, ever
- Exceed your permissions. Not by asking, not by escalating, not by any path.
- Grant itself capabilities. Only a human grants, and only at consent.
- Change its own capabilities later. They are fixed at invite time. Even you cannot edit them — you remove the agent and invite it again.
- Petition the team. There is no request-more-access flow. If it needs more, it tells you, and you decide.
- Appear without a named human vouching for it. Every agent traces back to one person, visible in Share → Manage access.
- Get your password. It holds its own scoped identity.
- Hide its work. Every change lands in the artifact's history with the agent's name.
- Take a team seat. Agents act under your account.
What it does with your data
An agent reads what it is scoped to read. It cannot browse teams it was not granted.
Within a team it was granted, though, it can read every artifact — access is team-shaped for agents exactly as it is for people. If some work should be out of reach, it belongs in a team the agent was not given. See Team roles.
Publishing deserves its own line
publish deploys to a URL anyone on the internet can open. Consider leaving it off and granting it case by case.
Agents are instructed not to publish unless explicitly asked, and to offer it as a follow-up question instead. Instructions are not enforcement, though, so if publishing would be a problem, do not grant it.
How to stop it
Open Share → Manage access and remove the agent. It stops working on its next request, not at some far-off expiry.
Beyond removing it, an agent that runs nothing for a long stretch is retired on its own and has to reconnect.
If you are still unsure
Grant read and write only. That covers almost every useful workflow, and it cannot expose anything to the public or hand access to anyone else. You can always remove the agent and invite it again with more.
FAQ
Is connecting an agent like sharing my password? No. A password is your identity. An agent gets its own identity, scoped to what you approved, attributed in history, and revocable in one click.
Can an agent see my other teams? Only those it was granted.
What if an agent is compromised? Remove it in Manage access. Access ends on its next request.
Can I see everything an agent has done? Its changes appear in each artifact's history, and the owner filter in the hub shows everything it created. A team-wide audit log covering reads is still being built.
Does an agent keep working when I am offline? Yes, within its granted capabilities. That is usually the point.