Agent Permissions

status='ready' — the everyday panel. Flip a tool switch, type a new cap, add or remove a host, arrow through the file-access rungs: every edit stages a change and the bar counts how many of them EXPAND what the agent can do. Removing a saved host leaves the chip struck through with an undo, so a removal can be taken back before it is saved. Save fires once no matter how fast you click it, and the payload holds only what changed.

Agent permissions

What this agent may do on your behalf, and how far it may go.

Tools

4 of 7 tools allowed. A blocked tool is never offered to the model.

Web searchLow riskweb_searchRuns a query and reads the result snippets. Never opens a page by itself.

256 calls

Fetch a URLMedium riskweb_fetchDownloads a page — but only from a host on the allowlist below.

378 calls

Read filesLow riskread_fileOpens files inside the workspace root. Honours the file-access rung below.

438 calls

Edit filesMedium riskedit_fileWrites changes back to disk, including files you didn't name.

12 calls

Run shell commandsHigh riskrun_shellExecutes commands in the sandbox with the agent's own credentials.

170 calls

Send emailHigh risksend_emailSends mail from your workspace address. Recipients can't tell an agent wrote it.

446 calls

Reconcile customer entitlements (internal MCP)High riskmcp__internal_platform_services__reconcile_customer_subscription_entitlements_v2Rewrites entitlement rows for a customer account in the billing platform.

269 calls

Spend cap

Set by Dana · Mar 12. The agent stops when the cap is reached.

Cap this month

$41.36 spent of $120.00 this month

Usage is metered by your provider; the cap is enforced before each call.

Network allowlist

4 of 20 hosts allowed. Everything else is refused before the request leaves.

docs.zyeon.ai, Product documentation
*.githubusercontent.com, Raw files from public repositories
api.stripe.com, Read-only billing lookups
very-long-subdomain-name.internal-platform-services.acme-corporation.example.com, Internal platform gateway — the host name is long on purpose

File access

Everything below applies inside /workspace/acme-web only.

no save has fired yet

status='ready' under an org policy — three things are already wrong when it loads. The saved cap ($400) sits above the plan ceiling, the saved file scope sits above the policy ceiling, and the month's budget is already spent; the panel opens with those two corrections STAGED rather than showing values the server doesn't have. 'Send email' is locked, so 'Block every tool' steps over it, and the pinned host has no remove control at all.

Agent permissions · Acme workspace

Your organisation manages part of this policy. Locked rows and ceilings are enforced server-side.

Tools

4 of 7 tools allowed. A blocked tool is never offered to the model.

Web searchLow riskweb_searchRuns a query and reads the result snippets. Never opens a page by itself.

256 calls

Fetch a URLMedium riskweb_fetchDownloads a page — but only from a host on the allowlist below.

378 calls

Read filesLow riskread_fileOpens files inside the workspace root. Honours the file-access rung below.

438 calls

Edit filesMedium riskedit_fileWrites changes back to disk, including files you didn't name.

12 calls

Run shell commandsHigh riskrun_shellExecutes commands in the sandbox with the agent's own credentials.

170 calls

Send emailHigh riskLockedsend_emailSends mail from your workspace address. Recipients can't tell an agent wrote it.

446 calls

Your workspace policy blocks outbound mail for every agent. Ask an owner to change it.

Reconcile customer entitlements (internal MCP)High riskmcp__internal_platform_services__reconcile_customer_subscription_entitlements_v2Rewrites entitlement rows for a customer account in the billing platform.

269 calls

Spend cap

Set by Priya · Feb 28. The agent stops when the cap is reached.

Cap this month

$212.90 spent of $200.00 this month

This cap is below the $212.90 already spent — the agent stops the moment you save.

Network allowlist

4 of 20 hosts allowed. Everything else is refused before the request leaves.

docs.zyeon.ai, Pinned by your workspace policy
*.githubusercontent.com, Raw files from public repositories
api.stripe.com, Read-only billing lookups
very-long-subdomain-name.internal-platform-services.acme-corporation.example.com, Internal platform gateway — the host name is long on purpose

File access

Everything below applies inside /workspace/acme-web only.

Your policy caps this at “Read only”. Write access needs an owner's approval in this workspace. The saved value was above it, so the reduction is already staged.

2 changes staged

no save has fired yet

status='ready' with disabled — the read-only rendering for a member without the permission. Every switch, rung and chip is still readable and reachable by keyboard (aria-disabled, not the native attribute, and the money field is readOnly so it can still be selected and copied), but nothing commits.

Agent permissions · read only

You need the Owner role to change what this agent may do.

Tools

4 of 7 tools allowed. A blocked tool is never offered to the model.

Web searchLow riskweb_searchRuns a query and reads the result snippets. Never opens a page by itself.

256 calls

Fetch a URLMedium riskweb_fetchDownloads a page — but only from a host on the allowlist below.

378 calls

Read filesLow riskread_fileOpens files inside the workspace root. Honours the file-access rung below.

438 calls

Edit filesMedium riskedit_fileWrites changes back to disk, including files you didn't name.

12 calls

Run shell commandsHigh riskrun_shellExecutes commands in the sandbox with the agent's own credentials.

170 calls

Send emailHigh risksend_emailSends mail from your workspace address. Recipients can't tell an agent wrote it.

446 calls

Reconcile customer entitlements (internal MCP)High riskmcp__internal_platform_services__reconcile_customer_subscription_entitlements_v2Rewrites entitlement rows for a customer account in the billing platform.

269 calls

Spend cap

Set by Dana · Mar 12. The agent stops when the cap is reached.

Cap this month

$41.36 spent of $120.00 this month

Usage is metered by your provider; the cap is enforced before each call.

Network allowlist

4 of 20 hosts allowed. Everything else is refused before the request leaves.

docs.zyeon.ai, Product documentation
*.githubusercontent.com, Raw files from public repositories
api.stripe.com, Read-only billing lookups
very-long-subdomain-name.internal-platform-services.acme-corporation.example.com, Internal platform gateway — the host name is long on purpose

File access

Everything below applies inside /workspace/acme-web only.

status='ready' with spend={null} and sections={['tools','files']} — a sandboxed deployment that meters nothing. A missing budget is a missing BLOCK, not a cap of zero, and the network block is dropped by the sections lever; the panel loses two whole sections without losing its shape. File access is locked here, so the radiogroup is readable but frozen.

Agent permissions · sandboxed

This agent runs in a sandbox with no budget and no file system.

Tools

4 of 4 tools allowed. A blocked tool is never offered to the model.

Web searchLow riskweb_searchRuns a query and reads the result snippets. Never opens a page by itself.

256 calls

Fetch a URLMedium riskweb_fetchDownloads a page — but only from a host on the allowlist below.

378 calls

Read filesLow riskread_fileOpens files inside the workspace root. Honours the file-access rung below.

438 calls

Edit filesMedium riskedit_fileWrites changes back to disk, including files you didn't name.

12 calls

File access

How far into your files this agent may go.

This agent runs in a read-only sandbox with no file system attached.

status='loading' — the saved permissions haven't arrived. Skeleton rows, aria-busy, and the pulse stops under prefers-reduced-motion.

status='empty' — an agent with no tools, no network and no files to scope. Not an error, and not an editor with nothing in it.

Nothing to scope

This agent answers from the conversation alone — it calls no tools, reaches no network and touches no files, so there is nothing here to allow or deny.

status='error' — the permissions failed to load. No half-open editor: switches nobody can trust are worse than none, so the panel offers a retry instead; pressing it swaps in the ready payload.

Couldn't load these permissions

The policy service returned 503. request-id: 9f31-4ac7