# The risk rule

> The one rule that decides what an Agent host agent may do alone and what waits for a person: safe tools, risky tools and what is not offered.

Source: https://agenthost.geenius.io/docs/risk-rule/

One function decides, and the approval gate reads only it.

| Tool | Risk |
| --- | --- |
| Web fetch, when on | Safe |
| Web search, when on | Safe |
| Webhook | Risky, always |
| A connector tool you marked read-only | Safe |
| Any other connector tool | Risky |
| A tool the rule does not know | Risky |

A tool that is switched off is not offered at all and is refused before any question of risk.

> [!HONEST]
> If you mark a tool that writes as read-only, the gate lets it through. Mark carefully.