What counts as a write?

Anything that changes state in a connected tool: creating an issue, updating a CRM record, drafting or sending an email, posting a message. Indexbrain registers 141 of them across 30 apps, and all 141 default to asking first.

Can I let some writes through without asking?

Yes, per action. Setting one to always allow removes the prompt for that specific action only, and every change is written to the audit log.

What about reads that are sensitive?

Some reads cost third-party credits or touch personal data. Indexbrain flags 11 of them and defaults those to asking too, even though they are reads.

Can AI agents take actions in my tools safely?

Yes, if every action is permissioned individually and writes stop for a human, rather than the agent being trusted to behave.

Per-action permissions beat a policy document, because they are enforced rather than requested.

The strongest setting is not refusal: it is never offering the action at all.

Unattended work should be held to stricter limits than a person is.

Most AI governance is a document

A policy that says what an assistant should not do is only as good as the assistant's willingness to comply. That is an odd thing to rely on when the action is writing to a CRM or sending an email.

The alternative is to make the boundary structural: decide per action what the AI may do, and enforce it in the code path rather than in the prompt.

Three modes, and why the third is different

Always allow suits a plain read. Reading was never the part that needed permission, and asking every time trains people to click through prompts without reading them.

Ask every time suits writes. The run halts and shows the exact content it wants to write before it exists, which is the only moment a human review is worth anything.

Disabled is the interesting one. In Indexbrain it does not refuse the call: the action is never offered to the model, so there is nothing to talk it out of and no prompt injection that can reach it. That is the difference between a policy and a boundary.

Unattended work needs stricter limits

An agent running on a schedule has nobody watching it, so it should be allowed less than a person is, not the same amount.

In Indexbrain, write access for scheduled work is a separate opt-in from write access in chat, and a scheduled routine can never reach shell execution on any plan with any setting.

Try it free See it work