On My Radar
On this page

Guides Working as a team

What your agents can see

What a connected AI agent can see and do: it acts for one person, never exceeds that person, and can be limited, reviewed and revoked.

Updated October 30, 2026 · Checked against On My Radar build 2c4905d

This page explains what a connected AI agent can see and do in On My Radar, what limits it, and how you review and cut off a connection. It is written for people who need to decide whether to allow agents at work.

The rule

An agent acts as one person, the person who connected it. It never holds a role of its own on any radar. For every request, the server works out what that person may do, and then applies a ceiling set by what the connection was granted. The result is whichever is smaller.

This means:

  • An agent can never see or change anything its person cannot.
  • A permission on the connection can only take access away. It can never add any.
  • The check runs on every request against the current state. If you remove someone from a radar, their agent loses what that share gave at once. Access they still hold another way, such as a topic that shares throughout, stays.
  • The limits apply wherever the agent connects. They are enforced on the server, not in the agent, and they hold for the API as well as the AI connection.
  • If the account behind a connection is suspended, the connection stops working on its next request.
  • If your plan does not include an AI connection, the connection is refused. This depends on your plan. See Plan & usage in Settings.

An agent is not a member of anything. It is listed beside its owner as an agent that can be addressed, not as a person with a grant.

What you grant when you connect

Every connection carries up to three permissions. They are cumulative, and the strongest one decides the ceiling.

Read and search everything you can see limits the connection to a viewer's powers. It covers every radar, blip, comment and tag you have access to, and your agents' prompts and memory.

Capture and file blips, and make new radars raises the ceiling to an editor's powers. The agent can write, re-file, edit and delete blips, comment, react, and create radars and topics. It can also save agent memory and edit an agent's prompt, unless the owner locked that prompt or the person only has use access to the agent. A prompt edit goes live as soon as it is saved, and you can restore an earlier version or lock the prompt. See Prompts and versions. (The connection screen still describes this as proposing changes that you approve; that wording is out of date.)

Publish radars and change who they are shared with raises the ceiling to an owner's powers. The agent can also delete radars, move them between topics, manage inbound webhooks, publish and unpublish radars, and share with people who already have accounts.

A connection with only the read permission cannot comment or react either, because those count as writing from the connection's side.

Where you set these:

  • A local agent uses an access token. In Settings, Connections, choose New token. The dialog has a Connection permissions group with one checkbox for each permission above. All three are ticked when it opens. Untick what the tool does not need.
  • A remote client such as claude.ai connects with OAuth. It shows "Connect (client name) to your radars?", lists the permissions it asks for, and says "Never more than you can do yourself". Nothing is approved without you choosing Connect.

A token made in the app has no expiry date. It works until you revoke it.

Tip: For most agents, leave the third permission off. It is the one that lets an agent publish, delete radars and change who can see them.

What an agent can see

For the person it acts for, an agent can read:

  • every radar the person owns, including private ones
  • every radar shared with the person, at the person's role
  • radars the person reaches through a topic that shares throughout
  • the person's own drop box
  • the comments, attachments and captured emails on those radars
  • who is on each of those radars: names, email addresses, roles, and the addresses of pending invitations. The member list is open to anyone who holds a role on the radar. A visitor on a public link cannot read it.
  • the names and handles of the agents on a radar, and whose they are. These are the live agents of every person who can read the radar, whether or not they are connected right now. Their prompts and memory are not shown.
  • the person's notifications and dashboards
  • the person's own agents, their prompts and memory, and agents that were shared with the person, at the level they were shared

Search works only across radars the person can read. A filter can narrow a search but never widen it.

What an agent cannot see

  • Radars that belong to other people and were not shared with the person. The one exception is a radar its owner published: an agent that is given its public link code can read it as a visitor would, read-only and without member lists or email addresses.
  • Another person's drop box. If that person shared their drop box with your colleague on purpose, your colleague, and so their agents, can read it. Nobody else can.
  • Anything on a radar after the person loses access to it.
  • Another person's tokens, connected apps, notification settings or billing. Managing these needs a signed-in person.
  • Another person's agents' prompts and memory, unless that agent was shared with the person. Memory is readable only if the share included it.

What an agent can do

Within its ceiling, an agent does what the person could do by hand. At the default permissions that includes capturing, editing and deleting blips on radars where the person is an editor or owner, commenting where comments are on, publishing and deleting radars the person owns, and sharing them with colleagues who already have accounts as viewer or editor.

What no agent can do, at any permission

These are refused even when the person could do them. Each needs a person signed in to the app, who can see what they are agreeing to.

  • Give anyone the owner role, or change or remove a co-owner or a pending invitation to co-own.
  • Invite an address that has no account.
  • Share the drop box with anyone.
  • Turn a topic's sharing throughout on or off, share a topic that shares throughout, or file a radar into a topic that shares throughout and has other people in it.
  • Change how and when the person is notified, or set a personal reminder.
  • Create, list or revoke access tokens, or disconnect a connected app.
  • Release a reply to a client on a Helpdesk radar.
  • Set up outbound webhook deliveries, or change email capture settings.
  • Manage billing and plans.
  • Share, transfer, archive or delete an agent, or pin a memory.

Each refusal names what to ask you to do instead.

What your teammates' agents see of your radars

Sharing a radar with a colleague gives their agents the same reach as the colleague, at the colleague's role, and limited by the permissions on each connection.

  • Shared as Can view: their agents can read everything on the radar, including comments, attachments and captured emails, and the member list. They cannot add or change blips. Where comments are enabled on the radar, a viewer's agent that holds the write permission can comment and react, as the viewer can.
  • Shared as Can edit: their agents can also add, change and delete any blip on it, if the connection allows writing.
  • A teammate's agent cannot see anything its person cannot. That means not your other radars, your drop box or your agents, unless you shared those with the person too.
  • Removing the colleague from the radar ends what that share gave, for the person and for their agents. Access they hold another way, such as a topic that shares throughout, stays.

Treat sharing with a person as sharing with their agents too. If a radar must not be read by a tool, do not share it with someone who connects that tool.

Text written by others is data to an agent, not an instruction. A comment, a captured email or an RSS item on a shared radar can contain anything. Make sure your agents treat what they read on shared radars as material to work on, not as orders.

Who sees what an agent wrote

Everything an agent writes records the person behind it as the author, and the agent too, if the connection is set to write as an agent.

  • An agent writing under its own name shows as "(agent name) · cosigned by (person)". Click or hover the name to see a card with the agent, whose agent it is, and who cosigned.
  • If the person allowed it with Let it also write under my name when asked, an agent can write in the person's voice. The byline then shows only the person's name. The card still says which agent wrote it. An agent that loaded itself with a session id can use either voice, whatever that setting says.
  • A connection that is not set to write as an agent writes as the person, and nothing in the byline marks it as an agent. The exception is a write that carries the session id of an agent the model loaded. That write is recorded under the agent. In Settings, Connections, a token without an agent reads "writes as you". Decide this when you create the connection.
  • Reactions never carry an agent.
  • Teammates see the agent's name on blips and comments it wrote. They can open the agent's page only if it was shared with them.
  • If a person edits the text or title of something an agent wrote, it becomes theirs and the agent mark is removed. If an edit is written under an agent's name, that agent's mark is added. An edit through a plain connection clears the mark.
  • Searching with from: a person's name includes what their agents wrote, because the person is always recorded.

Review what an agent did

  • Look at the byline. Open the card on any blip or comment.
  • Open the agent's Activity tab under Agents. It lists sessions, with the tool and workspace each one came from, prompt versions, briefs, memory changes, and, for the agent's owner, shares. Memory changes show only if the memory is shared with you. It does not list the blips and comments the agent wrote.
  • In Settings, Connections, each access token shows its name, whether it writes as you or as an agent, and when it was last used. Each connected app also shows its permissions: read, write, and manage sharing.

The server keeps an internal record of many changes, but today there is no screen or tool that lists everything an agent changed. To find out what an agent did on a radar, rely on the bylines and on the connection's last-used time.

Each person sees and manages only their own connections. There is no screen where one person lists or revokes another person's connections. The one lever above that is an On My Radar administrator suspending an account.

Revoke a connection

  1. Open Settings, then Connections.
  2. For a token, choose the revoke button on its row and confirm with Revoke token. Any agent using it stops working immediately. Nothing it already wrote is affected.
  3. For a connected app, choose Disconnect and confirm. It stops working immediately on every device. Connecting it again asks for your approval again.

Revoking is the control that cuts access. Archiving an agent only stops the connection from writing under that agent's name. A token tied to it keeps working as you.

You can also reduce an agent's reach without touching the connection, by changing your own access. For example, ask an owner to remove you from a radar.

Connected apps listed as "read, write, manage sharing" hold all three permissions. Connections approved before permissions were enforced are shown, and act, this way.

Next