AI assistant
Assistant autonomy and confirmations
Understand View only, Ask first, and Full access, plus the conversation controls Autonomous and Action on Accept.
Assistant autonomy narrows what the assistant may do. It never expands the signed in user's normal role, module access, model permission, record scope, or workspace access.
Permission levels
The underlying permission system has three levels:
| Level | Tool access | Confirmation behavior |
|---|---|---|
| View only | Read tools only | No write tool is offered to the model |
| Ask first | Read and write tools | Every write, risky action, and irreversible action pauses for confirmation |
| Full access | Full tool surface | Ordinary create and update actions can run, while risky and irreversible actions still pause |
The safe fallback is Ask first when no valid preference has been stored. A missing or legacy value does not silently become Full access.
Composer controls
The chat composer presents the two interactive choices:
| Composer label | Stored behavior |
|---|---|
| Action on Accept | Ask first |
| Autonomous | Full access |
In Action on Accept, every mutation pauses. In Autonomous, ordinary creates and updates can run within your authority, but destructive or high impact actions still show a confirmation card.
Examples that continue to require confirmation in Autonomous mode include delete, cancel, refund, publish, send, and charge actions when classified as risky or irreversible.
View only is an administrative ceiling rather than a third composer button. When the effective ceiling is View only, the assistant receives only safe read tools even if the composer visually falls back to Action on Accept.
Which setting wins
The effective mode is resolved in this order:
- The current conversation's stored override
- Your user default
- The workspace default
- Ask first as the safe fallback
Changing the composer mode for an active conversation stores the choice for that conversation. A more specific conversation choice can therefore differ from your general user or workspace default.
What confirmation means
A confirmation card identifies the pending tool and its proposed input. Selecting accept resumes the turn and dispatches that exact pending request through normal server authorization. Selecting deny tells the assistant the action was refused and allows it to continue without executing it.
Confirmation is not a bypass. The action can still fail because the record changed, the workspace became read only, the module is unavailable, or your permission was revoked between proposal and dispatch.
Role and record boundaries still apply
Every tool call is checked against:
- The live signed in user
- Workspace identity
- Installed and entitled modules
- Role requirements
- Model permissions
- Record ownership or scope
- Read only subscription state
- Action validation
Autonomous mode cannot promote an employee to administrator authority, cross into another tenant, or act on a record that the user cannot access.
API and MCP are separate
Assistant autonomy controls the in app chat tool loop. API and MCP keys act as their bound user and do not use the chat composer toggle. Their authority is determined by the key's actor, creator privilege ceiling, module access, model permission, and MCP seat entitlement.
Recommended operating policy
Use Action on Accept for finance, payroll, user administration, security, billing, publishing, customer communications, and any new workflow. Use Autonomous only after you understand the exact tool behavior and are comfortable with ordinary writes running without a card.
Keep destructive confirmation enabled by design. Do not interpret Autonomous as unattended permission to delete, charge, refund, send, or publish.
Troubleshooting
I selected Autonomous but the assistant still asks
The proposed action is classified as risky or irreversible, or an administrative ceiling is stricter than the composer selection. The confirmation is expected.
I selected Action on Accept but a read ran immediately
Read tools are safe class actions and do not mutate records. Ask first begins confirmation at the write class.
The assistant cannot see a tool
View only removes all write tools. Other missing tools usually mean the required module is not installed or your account lacks access.
A confirmed action failed
Read the returned server error. Confirmation approves an attempt; it does not guarantee stale data, validation, billing, or authorization checks will pass.