Tool permissions
The three permission states, the three access levels, the defaults you start from, and the exact order the guard follows when an agent calls a tool.
Connect
Every tool of a connector carries exactly one of three states: Off, Ask or Allow. Any other value is refused when it is saved.
The three states
| State | What happens when an agent calls the tool |
|---|---|
| Off | Refused immediately. Nothing is attempted and nothing is asked of you. |
| Ask | A signature request is created and the call waits for you. |
| Allow | Executed straight away, with no question. |
The three levels
The tools modal groups them under Read only, Write and edit, and Critical actions. The level of each tool is written by hand, tool by tool. It is not guessed from the name.
Across the six official connectors: 8 read tools, 11 write tools, 4 critical ones. The four critical tools are commit.push, db.sql_execute, domain.dns and refunds.create.
What you get by default
When you have set nothing, a read tool is on Allow. Everything else, write and critical alike, is on Ask. The same calculation is made on the server and on the screen, so the two agree.
Setting a whole section at once
Each section carries an All row. The buttons differ on purpose.
- Read only offers Allow and Ask.
- Write and edit offers Ask and Turn off.
- Critical actions offers Ask alone. No bulk button allows a critical action.
There is no Save button
Each click sends the whole set of permissions to the server at once. When that fails you get a toast. It says the permissions were not saved, that the screen shows your setting and the server never received it, and that you should reopen the connector to see its real state. Take that literally.
What changes when an agent runs
The guard decides in this order, and the order is what makes it safe.
- An action the agent forbids itself is refused. It is never even proposed.
- The connector permission is read. Off refuses, Ask requires your signature, Allow executes.
- A verb with no effect outside MaShop, such as reading or listing, executes.
- An agent set to autonomous executes.
- Otherwise your signature is required.
Allow is read before the agent autonomy setting
A tool set to Allow runs even when the agent is in draft or signature mode. Setting Allow on a write tool removes your review for that action, whatever the agent is set to.
When a tool is on Ask, the guard writes a signature request and the call stays in the waiting state. If that write itself fails, the action is refused and nothing is attempted. A request that could not be recorded never becomes a silent execution.
A request that moves money needs the owner signature, unless the owner has opened that right to editors. Money is decided on the verb, never on the amount. A refund with a missing amount is still a refund.
Critical adds nothing further at run time. The guard reads only Off, Ask and Allow. What the critical level really buys you is the Ask default and the missing bulk Allow button.
Where a tool from an MCP server lands
A remote tool is addressed as mcp:server:tool. The guard reads that name like any other, and it matches a stored permission on the bare tool name at the end.
But no screen lists the tools of a connected MCP server today. So nothing is there to set, and no permission is stored for them. The full name matches no safe verb either.
The consequence is worth knowing before you connect one. A remote tool falls through to the last step and asks for your signature, every time, unless the agent is set to autonomous.
Who can change a permission
The owner of the project, and nobody else. An editor or a viewer can read the permissions. Saving is refused for them.
Limits
- Three states, per tool, per project. Any other value is rejected at write time.
- Thirty permission saves per minute.
- Permissions are stored once per project and per connector.
What to watch
- Reopened from the chat, the tools modal shows the defaults again, not what you saved. The screen and the stored setting can disagree.
- A permission is stored under the bare tool name.
domain.verifyexists on both Vercel and Resend, so one setting covers both. - Saving a permission on a connector you never connected creates an active connection row. The system then treats that connector as connected while no account was ever linked.
- The 23 tools of the six official connectors have no executor yet. Setting one to Allow authorizes nothing that can run today.