Permissions

ThinkForge agents use a capability allow-list model. Each agent can only do what was explicitly included in its design — no more.

Permissions are determined at creation time and enforced at runtime. There is no separate permissions dialog each time you run an agent. The boundaries are built into the agent definition.

How permissions work

When you create an agent, the planner selects capabilities from an approved list based on your description. Only capabilities marked as safe for user-created agents are available. The full list of chosen capabilities is shown in the approval summary before you confirm creation.

At runtime, every step is checked against the agent's allowed capabilities. If a step tries to use something not in its allow-list, it fails.

What agents can do

Common capabilities available to agents:

  • Process content with AI (summarize, rewrite, analyze, transform)
  • Display results and stream output
  • Read files (secondary references, templates)
  • Write output files to a configured folder
  • Search project memory
  • Search and list files in the project
  • Validate input (email, URL, JSON format checks)
  • Create or modify mind maps
  • Call configured external APIs (one service per agent)
  • Search conversation history

What agents cannot do

  • Create, modify, or delete other agents
  • Access system administration functions
  • Copy, move, or delete project files (only read and write-new are available)
  • Assign their own triggers — you configure triggers manually
  • Spawn other agents recursively
  • Access capabilities not in their allow-list
  • Improvise new abilities at runtime — the step list is fixed

Safety controls

ThinkForge enforces several layers of safety:

  • Capability tiers — skills are rated by risk level. User-created agents are restricted to safe tiers. Dangerous or administrative capabilities are excluded from the creation process entirely.
  • Planner allow-list — the creation AI can only propose capabilities explicitly marked as safe for agents. It cannot suggest hidden or destructive operations.
  • Registry validation — every proposed capability is verified against the live skill registry before the agent is saved. Invalid or unknown skills are rejected.
  • Path safety — file operations check for dangerous path patterns (directory traversal, system paths) and block them.
  • API credential gates — agents that use external services require you to configure credentials first. The AI never handles API keys directly.
  • Guided mode — optional human approval after each AI step for high-stakes workflows.
  • Memory scope — agents can be scoped to session, project, or global memory, limiting how far they reach into stored knowledge.
Permissions are static. An agent's capabilities are locked when it is created. Running it does not grant additional permissions, and the agent cannot request elevated access during execution.

Memory scope

Each agent has a memory scope that controls what project memory it can access:

  • Session — only data from the current run
  • Project — the active project's memory
  • Global — can search across all projects

This is set during creation and visible in the agent details.

Related