Tool access

Each Tool binding explicitly lists allowed operations. A connection grants a particular audience—HTTP, MCP, or browser UI—access to one instance and its current state generation. Choose permissions based on what the agent should be able to do. Read access to a mailbox need not include sending messages. Access to one synthetic service does not grant access to the rest of your organization.

​

Connection identity is not a simulated personality

A connection’s purpose and allowed operations describe authority. They do not automatically change the target agent’s prompt, user role, or behavior. Put any intended task context or simulated persona into your scenario’s explicit input. Keep credentials outside that input.

​

Reset invalidates previous access

Restoring a snapshot advances the instance’s epoch. Connections to a previous epoch cannot act on the restored state. Obtain fresh bindings instead of changing a stale credential’s fields. See connect your agent and team credentials.