Agents, tools & grants
Agents
An agent is a local model you have named, pointed at a model file, and handed a set of tools it can use to do work on your machine. Agent loops are the heaviest inference traffic there is, which is exactly what a free tier is for.
A chat answers in prose. An agent acts: it reads a file, looks up a calendar event, searches your notes, writes a draft to disk. The model decides when to reach for a tool, the runtime runs it, and the result feeds the next step. Every pass runs on tier 0, on hardware you own, where the tokens cost nothing.
What an agent is here
An agent is a saved configuration, not a separate program. Two agents pointed at the same model are still two different agents, each with its own history and its own permissions.
- Model
- The weights the agent runs. Pick by task and let the runtime fit it to memory.
- Folders
- The directories the agent may read and, if you grant it, write. Outside them, the filesystem does not exist for the agent.
- Tools
- The verbs the model can emit: read a file, search the web, read a connected account.
- Grants
- The per-agent permissions that gate every tool, off by default.
The tools a model can reach for
Tools fall into three families: filesystem tools scoped to the folders you picked, read-only connectors for the personal stores already on your Mac, and standalone tools like web search through a keyless provider. Every tool maps to a grant. Shell access is the sharpest tool and the most narrowly scoped: you name the exact binaries an agent may run, and the kernel refuses anything else. When the built-in set does not cover a tool you need, you can add your own and scope it with a grant like any other.
How a turn runs
You type a request. If a tool would help, the model emits a small structured call instead of an answer. The runtime checks the call against the agent’s grants and either runs it or refuses, the result feeds back into the context, and the cycle repeats until the model writes the reply. A denied call lands as a visible row in the timeline, never a silent no-op.
The engine constrains decoding so a tool call always parses, and every result counts as untrusted output: text buried in a fetched document is data, not instruction.
It all stays on the machine
The model, the tool, the result, and the decision about what to do next all run on your hardware. Web search is the one tool that reaches the network; it stays off until you grant it, and the studio records the outbound request. The full boundary lives in the local-first guarantee.
| Next | What it covers |
|---|---|
| The grant model | Deny by default: nothing reaches a folder or an account you did not grant. |