Tool access

Decide which tools each agent may call and with what, so a model that has been talked into something still cannot do it.

1. See what an agent may call

   Open an agent and choose Access. Each row is a tool it may call, with its risk, its limits, and how often it was used. Any tool not listed is refused.

   

2. Allow what it tried

   Tried but not allowed lists the tools the agent called and was refused. Press Allow on each one it should have, or Allow all. This is the quickest way to draft access from real traffic.

   In the appCLI

   Found in its code lists the tools the scan saw but nobody allowed yet. To add any other tool, pick it in Add a tool… and press Allow.

3. Limit a tool

   Click No limits · add on a row, press + Limit, and fill in an argument, a comparison and a value, for example rows ≤ 5000. Press Save. A call outside the limit is refused.

   In the appCLI

   Every change saves at once and is written to the audit log.

4. Require approval

   Set the row's Permission to Ask first. Every call to that tool now waits on Approvals until a person approves or denies it.

   In the appCLI

   For a tool in Tried but not allowed, press Allow with approval.

Tool impact

Each tool has an impact, guessed from its name and description. Check it in the Risk column: a tool that moves money but is marked Read only is not protected.

A value copied out of a lower-impact tool's output into a higher-impact tool is refused outright. If that flow is intended, for example an address from your own CRM, mark the CRM tool's output trusted with agentfox declare tool.

Where an argument came from

Accepts values from sets the most a tool trusts. A value from further down the list than the setting allows sends the call for approval. See Core concepts.