AI Agent uses four controls for connected services. The first two limit what an agent can reach. The third lets a person review each external change. The fourth covers workflows that run without anyone watching.
The four controls
| Control | What it decides | Default |
|---|---|---|
| Connection limits | Tool permissions on each connection decide which Actions and Destructive tools any agent may call on that account. | Reads are always on. Actions are on. Destructive tools are off. |
| Agent access | An agent you create uses only the accounts you attach to it, and you can switch off tools for that agent. Built-in agents marked system use every connection in the project. An agent can narrow a connection’s limits but never widen them. | An attached account gives the agent All tools that the connection permits. |
| Approval | When an agent proposes an Action or a Destructive tool, a person reviews the provider, the account, and the arguments, then approves or rejects. Approving continues that one proposal. Rejecting stops it. | Every Action and every Destructive tool waits for approval. |
| Workflow consent | A workflow Tool step that writes to a connected app, a Send step that emails people outside your organization, and an HTTP step that is not a GET can run without a person after one permission. When you set the trigger live, Allow these writes? lists each change. After Allow and set live, those steps run without an approval card. |
A trigger with such steps cannot go live until you allow them. |
Workflow consent is what lets a workflow write run without an approval card. It covers only the writes listed in the dialog, and you give it before the trigger goes live. A step whose permission was never granted, or was revoked, does not run. The full rules, and how to revoke a permission, are in Approvals.
Personal and shared access
- A connection is shared with the project by default.
- A Gmail inbox can be personal. Only the person who connected it can see it, reply, or change its settings, and you cannot attach it to an agent as a connection. See Connect Gmail.
- When a member leaves the workspace, their personal connections are disabled. Shared connections that they created stay in place.
Assistants that act as you
Claude, ChatGPT, and other AI assistants can work in your workspaces as you once you connect them. To review them, open Settings, then My account, then Profile. The Apps section lists each connected app. Click Revoke to remove an app’s access at once. See Connect Claude or ChatGPT.
Review access over time
Recheck connection access when an agent’s role changes, a teammate leaves, an account is replaced, or a workflow begins to make different kinds of changes.