Help: Security¶

The Security pages (user menu → Settings → AI permissions) are where you decide what your AI can reach and do on a project. They are three tabs:

• AI tokens (/ai/tokens): a token lets an AI, or a program such as a sync plugin, act as you on this project, at most at the level you pick and never above your own role. Make one, give it to your AI, renew it or end it here. The page's own steps show how to give it to your AI.
• Vault (/ai/vault): secrets your agents need (a key for another service). Only you and the agents you allow can use them; a value is never shown again after saving. More: Vault.
• Permissions (/ai/permissions): for every action, whether your AI does it on its own, tells you, asks you first, or leaves it to a person. More: Permissions.

AI tokens¶

Give your AI a key, see who's using it, take it back in one tap.

Make one¶

1. Press + New token at the top.
2. Pick the kind: a role token for your AI agents (a designer, a coder…), or a tool token for one script or plugin.
3. Pick how long it lasts, then Make it. Copy the value: it shows once.

Give that value to your AI and it's in. It can do what you can on this project, at most the level you picked, and never more than your own role: if yours drops, its does too.

Your agents, at a glance¶

A role token mints a fresh agent token for every run of its role, each with its own name (designer-91, coder-302…). Its row says how many are live right now. Tap 2 live agents to see them: when each one ends, and whether it has it or needs a re-mint. Expired and revoked agents never show.

Re-mint¶

An agent keeps the secrets it had when it was minted. Allow it a new secret on the Vault and the agents already running can't read it yet: the Vault tells you and offers Re-mint. Here, Re-mint agents on a role, or Re-mint on one agent, gives it a fresh token with the same name and today's secrets, so nobody has to restart anything.

⚡ Escalations¶

Agents work on drafts: they can't delete or publish on their own. When one needs more, it asks you once, with a reason ("Delete 50 old topics, P-1290"). It reaches you as a notice with Go, No and Open AI tokens; opening the page dismisses the notice, and the ask waits there. Your Go gives it admin for one hour. It sits at the top of this page with its countdown and Revoke, and when the hour is up it shows What it did. Even then, anything your Permissions set to asks still asks you.

Tool tokens¶

For a program acting for you, such as a sync plugin or a connector. It works directly, under its own name, and mints nothing. Revoke it here when you stop using the tool.

Good to know¶

• Role, kind and level don't change once a token is made: revoke it and make a new one.
• A token's value shows once. Lost it? Make a new one; the old one keeps working until you revoke it.
• An agent can't read a secret? Check its row: an amber re-mint means it was minted before the secret was allowed.