Control what the agent can do: tools & permissions
More AI’s agent can read and write files, run commands, search the web, schedule routines and connect to other apps. Every capability can be switched off; command approvals then follow the selected access mode.
The More AI team · Updated September 14, 2026
One switchboard for every capability
Settings → Agent tools lists every built-in capability with its own switch. Turn one off and it is removed from the toolset across Cowork, Code, compatible earlier Chat conversations and headless routines. This is policy, not a per-message prompt: a disabled tool simply never reaches the model.
The permission model
Beyond the switches, Code access modes decide how much the agent may do on its own. Auto follows configured command rules and approvals. Full Access turns off normal approvals and sandboxing, so ordinary risky commands do not pause; catastrophic commands remain blocked, and writes to protected files still require approval.
Connect your own apps
Connectors (via MCP) let the agent reach tools like Gmail, Google Drive or your own services. Each connector’s read actions can run freely while writes ask for confirmation, and you choose exactly which connectors any routine is allowed to use.
Permissions for unattended runs
A routine uses the permissions and execution mode you configure. Read-only or ask modes withhold actions that need interactive approval; configured unattended or Auto/Full access can permit writes and commands within their remaining restrictions. Start with a manual read-only run and inspect its available tools. Scheduling does not make a routine harmless or guarantee that every action will complete.
Frequently asked questions
What happens when I turn a tool off?
It is removed from the toolset across Cowork, Code, compatible earlier Chat conversations and routines. A disabled tool never reaches the model; it is policy, not a per-message prompt.
How are risky actions handled?
It depends on the workspace and access mode. Cowork deletion asks explicitly. In Code, Full Access disables normal approvals and sandboxing, but catastrophic commands remain blocked and protected-file writes still ask; other modes apply their configured approvals.
Can the agent connect to my other apps?
Yes, through connectors (via MCP) such as Gmail or Google Drive. Read actions can run freely while writes ask for confirmation, and you choose which connectors each routine may use.
Can I stop the agent from running commands or using the web?
Yes. Settings → Agent tools has a switch for every capability; turn one off and it is removed from the agent’s toolset entirely, in every mode. A disabled tool never reaches the model — it is policy, not a per-message prompt.
Do these controls apply to scheduled routines too?
A routine uses the permissions and execution mode you configure. Read-only or ask modes withhold actions that need interactive approval; configured unattended or Auto/Full access can permit writes and commands within their remaining restrictions. Start with a manual read-only run and inspect its available tools. Scheduling does not make a routine harmless or guarantee that every action will complete.