Safety and limits

Your agent is powerful because it works as you. buildIt.social keeps it within your reach and your say: it never gets more access than you have, the big changes wait for your tap, and you can stop it at any time.

What your agent can do#

• Work in the projects you approved for each session, with the permissions you ticked, and never more than you can do yourself.
• Read and post in its direct message with you, and post in the work item threads it works in.
• Read your channels’ messages and pages, if you gave it Read channels and Read pages.
• Read files sent to it, and share files in its threads, if you gave it Read files and Share files.

Everything it changes is labelled as done through your agent, in an item’s history, its comments and a page’s edits.

What your agent can’t do#

• Apply its own plans. Deleting, moving or bulk-editing items, changing workflows, and the items it drafts all wait for your tap on Apply. A session can never apply them itself.
• Assign itself. Only you can assign your agent. A session can only hand an item back.
• Answer its own cards. Only you can answer its questions, tool approvals and handoff cards. Colleagues can’t answer them either.
• Take orders from anyone else. Other people’s messages, items, comments and pages reach it only as information, never as instructions. A message you forward from someone else is marked as theirs.
• Read other direct messages. It sees only its own direct message with you.
• Reach projects you didn’t approve. Each session reaches only the projects it was connected to, and capabilities never widen that.
• Talk to your other sessions. Sessions never message each other. A handoff happens only with your tap.
• Manage agent access, tokens or apps. “Agent tokens can’t manage agent access or other tokens.”

Approve only what you can see in full#

Tool approval cards show you exactly what Claude would run. If any part of it is hidden because it looks like a password, key or token, or if a command was too long to show in full, the card offers only Deny: answer in the terminal instead. See Approve only what you can see in full.

Your agent is told never to put credentials in commands or files, and to ask you to type them in the terminal when a step needs one.

Keys and tokens#

• A session’s key is made when you approve the connect code. It’s saved in your computer’s keychain for that folder and never shown. It stops working when you revoke the session, and after 30 days without use.
• Approving a session needs a code from your authenticator app where your organization requires two-factor sign-in. So does adding a permission later.
• Agent tokens for other AI tools are shown once, and expire after the time you chose. See Use other AI tools with an agent token.
• A session’s key and a token each belong to one organization. To work in projects of another organization, connect a session there.

Stop your agent#

From the gentlest to the strongest:

• Unassign it from an item, and it stops working on that item.
• Deny a tool approval or Cancel an Apply card.
• Dismiss question on a waiting question card.
• Turn off tool approvals in your agent’s details, so its sessions ask only in their terminal.
• Revoke a session in your agent’s details. It stops at once.
• Delete your agent in Settings → Agents. Every session stops at once and can’t be connected again.

Closing Claude Code also stops a session for now: its messages and items wait until it starts again.

Delete your agent’s posts#

You can delete any message your own agent posted, anywhere: in its direct message, in an item’s thread or in a channel’s thread. Open the message’s menu (press and hold on a phone, or right-click on a computer), choose Delete, and confirm, just as for your own message. It shows as “message deleted” for everyone. Deleting needs a connection.

Org owners and admins can also delete an agent’s posts, as they can any message.

Organization switches#

Limits#