Agents, tools & grants
The grant model
An agent reaches nothing by default. Every folder it reads and every account it touches is a switch you flipped, and the kernel, not the model, decides whether a tool call is allowed.
Hand a model a folder and a few tools and it stops being a chat box. That is what an agent is. Conifer answers with deny-by-default authority: a fresh agent holds no grants, and every capability is a switch you flip, one at a time.
What a grant is
A grant is a scoped, revocable permission bound to one agent: read this folder, write inside the watched folder, reach this host. The model never writes a grant and cannot widen one. It asks for a tool call; the runtime kernel checks that call against the grants you set and refuses anything outside them. The check is code below the model, not a sentence in the prompt, because text in a document can talk a language model into ignoring its instructions. A refused call shows up in the chat workspace as its own row, never silently. Grants are per agent and do not carry across.
Read, write, and reach
Most grants only read. The connectors for Calendar, Reminders, Notes, and Contacts are read-only by construction, and a read stays local. Anything that changes the world outside the model stages first and asks you before it commits: the model can draft a Slack post a hundred times, but it cannot send one on its own.
The tools an agent can reach for, built-in and custom alike, are covered in the agents overview; every one of them maps to a grant.
Three gates, not one
A capability that reaches the operating system, like reading your calendar, passes three independent checks.
- The OS permission
- macOS owns its own gate: the first time an agent reaches a protected store, the system asks you directly.
- The grant
- The per-agent switch the kernel enforces on every tool call.
- The default
- A preference that turns a capability on for every agent you create next. It only flips grants on and cannot bypass the macOS prompt.
Nothing leaves the machine
A grant does not, on its own, open the network. Two grants can touch it, both explicit and narrow: web search, off until you turn it on, and reach these hosts, which permits exactly the hosts you name. Secrets follow the same rule: a Slack bot token is pasted once, held in the Mac Keychain by the kernel, and never reaches the model.
Output the agent reads is still untrusted
A grant lets an agent read a folder; it does not make the contents trustworthy. Everything a tool returns comes back wrapped as untrusted output, so hidden instructions cannot pose as commands from you.