Connect the system once
At the workspace level, by someone who is allowed to.
Tools and skills
Give each agent
the tools for its job.
Connect the capabilities a role needs, with access granted individually. Keep unrelated tools and data outside its scope.
Connect the system onceGrant it to a seatReview it later
Business context
Specialist agent
Least privilege by default
A new seat starts with nothing. You add what the job needs and no more.
Enforced outside the model
Permissions are not instructions in a prompt. A seat cannot talk its way into a tool it was not given.
Read and write are separate
Most seats only ever need to read. Treating those as the same grant is how accidents happen.
Revoke instantly
Pull a tool from a seat and the next run does not have it. No redeploy, no waiting.
How it works.
Grant it to a seat
Read or write, scoped to the job. Your researcher reads the CRM and cannot send from your domain.
Review it later
Permissions are listed per seat on one screen, so an access review takes minutes rather than a spreadsheet.
Scope and boundaries
- We connect to what a business actually runs on, not to two hundred logos. See what is connected on the integrations page.
- A tool we do not support yet is a conversation, not a switch you can flip.
- Granting write access to a system means a seat can change data in it. We make that explicit rather than bundling it.