What counts as risky, and who decides

An agent that can do things needs a rule about which things. In Agent host the rule is one function, and the approval gate reads nothing else.

The rule#

Web fetch and web search are safe when you turn them on: they read, and what they return is treated as data. The outbound webhook is risky, always: it sends something out. A tool of a connector is risky unless you listed it as read-only. And anything the rule does not know is risky.

Why this way round#

You could list the dangerous tools and allow the rest. That fails the day a connector adds a tool. So the default is the other way: every connector tool asks first, and you opt in to the ones that only read. Adding a tool to a connector never makes an agent more powerful behind your back.

Marking tools#

When you add a connector, you see its tools. Mark the ones that read: list the projects, read a note, search. Leave the ones that write: update a task, send a message. The gate lets the marked ones through and suspends the rest.

The caveat#

If you mark a tool that writes as read-only, the gate lets it through. The rule trusts your marking. Mark carefully and read the tool descriptions.

Who decides#

A person of the workspace, in the approvals inbox. The decision is recorded and the agent is told with a signed call. Your own AI, if it talks to your agents through Geenius OS, can read the queue and cannot answer it. We did that on purpose. If an AI could approve, an AI could approve its own webhook, and then the gate would only be a speed bump.

What a denied call looks like#

The model is told that the call failed because the owner denied it, and it can say so in its answer. Nothing happened.

See the risk rule and approvals.