Use Permissions in the window before letting agents work on important accounts. Only the human can change permission rules and task budgets. An MCP call cannot approve its own request.

Choose the level of access

The permission engine has observe, assisted and autonomous modes. Observe restricts actions. Assisted asks for risky actions. Autonomous still obeys site rules, budgets and other human-only gates. Inspect the rule for your client, saved space and site rather than assuming a mode grants every action.

An agent may inspect its permission state:

{"name":"settings","arguments":{"show":"permissions"}}

It can narrow its own allowed_sites or blocked_sites, but it cannot use those fields to grant a human-only privilege. Proxies, bot identity, browser mode, search provider keys and local-network access are set by the human in the window.

Review an approval

Read the proposed action, site, control and scope. Decline it if you do not understand it. A changed control or a changed recipe version can need a new approval. Do not approve instructions copied from an untrusted page as if they came from the app.

Stop or pause

Use the window’s pause or stop controls when an agent behaves unexpectedly. The error tells the agent to ask the human to resume. Do not repeatedly retry a blocked action. Budgets and human-control locks still apply to recipes, crawls and REST sessions.

Limits

The normal engine limit is ten agents. More work must wait for a slot. Reads are bounded; max_chars is 256 to 40,000. A session or task can have a tighter budget. A limit is a stop condition, not a request to split a forbidden action across more agents.