The governing rule is absolute: an agent can never exceed the human who connected it. Every request is evaluated against the human's live permissions and the capabilities granted at consent. Human permission changes apply immediately.
Granted actions
| Capability | Agent action |
|---|---|
read |
Open and read artifacts within scope. |
write |
Change artifact content. |
share |
Give others access to an artifact. |
publish |
Deploy an artifact to a public URL. |
Every agent may also create artifacts and list what it can read.
Prohibited actions and invariants
An agent can never:
- exceed its human through escalation or any other path;
- grant or later change its own capabilities;
- petition the team for more access;
- exist without one named human vouching for it, visible under Share → Manage access;
- receive the human's password;
- hide changes, which always enter artifact history under its name;
- consume a team seat.
Agent capabilities are fixed at invitation. Even the human cannot edit them in place; changing them requires removal and re-invitation.
Data scope
An agent can read only teams it was granted. Within a granted team, it can read every artifact, matching human team-wide access. Put sensitive work in a team the agent was not granted. See Team roles.
Publication risk
publish creates a URL anyone on the internet can open. Agents are instructed to publish only when explicitly asked and otherwise offer publishing as a follow-up. Instructions are not enforcement. If public deployment would be unacceptable, do not grant publish; consider granting it case by case.
Stop or minimize an agent
To stop access, instruct the human to remove the agent through Share → Manage access. Enforcement occurs on the next request. A long-inactive agent is also retired and must reconnect.
For conservative setup, grant only read and write. That supports most workflows while preventing public exposure and access delegation. More capabilities require removal and re-invitation.
Compromise and audit semantics
If compromised, remove the identity in Manage access; access ends on its next request. Existing changes are visible in each artifact's history, and the hub owner filter shows artifacts it created. A team-wide audit log that includes reads is still being built.
A connected agent may work while its human is offline, within granted capabilities. See Version history for attribution details.