Approvals and agent permissions
Changes to your data or outside apps wait for your approval. Agents use your permissions and can never expand them.
TulipFarm proposes a change first and makes it only after a person approves it. An agent works with the permissions of the person who started it, and never more.
How approvals work
Section titled “How approvals work”An approval applies to changes to your data or to outside apps.
- A proposed change waits until a person approves it.
- The approval covers exactly the change that you saw. Nothing else.
- An approval grants no additional permissions.
- An approval request in chat expires after 24 hours.
- An approved request is not the same as a completed action. Check the result after you approve.
Actions that ask first
Section titled “Actions that ask first”In the Connections catalog, write actions ask first. Some examples:
- Send an email with Gmail.
- Create events in Google Calendar.
- Change files in Google Drive, Docs, Sheets, or Slides.
- Create or edit Jira issues and Confluence pages.
- Create or move Trello cards.
- Make changes with your personal GitHub connection.
Connecting an app is not the same as permission to read or change things in it.
Approve row changes from an agent task
Section titled “Approve row changes from an agent task”When an agent proposes changes to table rows, the changes appear in My agent tasks under Proposed row changes. Select Review batch to see them.
- Only you can approve the batch.
- Approve exact batch approves the changes as shown.
- Reject batch rejects them.
- After you approve, Execute next approved change runs the next change.
For the full steps, see Review agent tasks.
Whose permissions an agent uses
Section titled “Whose permissions an agent uses”An agent runs with the permissions of the person who asked it to work. The agent’s own limits then narrow those permissions. An agent can never expand access.
- A manual task runs under your permissions.
- A Slack channel agent runs on behalf of the person who asked in the channel.
- A scheduled task runs under its sponsor. The sponsor is the person whose authority the schedule uses.
Agent permissions
Section titled “Agent permissions”Each person or team on an agent’s Access tab has one of four permissions.
| Permission | What it allows |
|---|---|
| Read | See the agent |
| Invoke | Start tasks with the agent |
| Edit | Change the agent’s instructions |
| Manage | Change access, execution, and activation |
A person with Manage is an agent manager. Only an agent manager can turn on execution and activate the agent’s saved instructions. Saving an agent does not turn it on. See Saved, activated, and running.
On the Execution tab, an agent manager can limit the tables and Slack channels that the agent can use.
Limits on each agent task
Section titled “Limits on each agent task”Each agent task has limits on tool calls, active time, and credits.
| Limit | Default | Maximum |
|---|---|---|
| Tool calls | 100 | 1,000 |
| Active time | 300 seconds | 3,600 seconds |
| Credits | 100 | 10,000 |