Connect
Your business becomes the agent's toolbox.
Customers, finance, email, service, content, website, analytics, people. Each connected system contributes a set of narrow capabilities to the registry — and contributes nothing else. The agent does not get a login to your accounting system; it gets "read an invoice".
The connection is not the permission
Connecting a system makes its capabilities available to grant. It grants nothing. Every agent still has to be given each capability individually, and most are given three or four.
Reads are scoped the way the system scopes them
An agent reading conversations sees the ones assigned to it, not the mailbox. A capability that quietly widens scope compared to the underlying system would make the underlying system's permissions meaningless.
One agent, several systems, one identity
A customer success agent can read an account, check its service history, look at its payment status and email its contact — as four granted capabilities under one identity, each recorded separately.
Disconnecting revokes immediately
Removing a connected system removes its capabilities from every agent holding them, and those agents stop rather than failing quietly halfway through a job.
Tools
The rest of this area.
Named capabilities with defined inputs, outputs and risk.
The tool registry
Every capability an agent could be given, in one list.
What a tool declares
Inputs, outputs, risk, permission, approval behaviour.
Risk levels
Four levels, and the policies that attach to them.
Your own tools
Expose your own service as a permissioned capability.
Adding external systems
The same architecture, more tools. No redesign.
Give AI a job.
Build an agent, choose what it can access, define what it may do, and deploy it to work safely across your business.
No code required · Full SDKs and API · Stop any agent instantly · [email protected]