> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rivvi.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Tool permissions

> Decide exactly what the agent can do with each connected tool.

Connecting a tool doesn't hand the agent the keys to everything. You control **each capability** a connector exposes — separately, and at any time.

## The three settings

Every tool a connector offers has one of three settings:

<CardGroup cols={3}>
  <Card title="Always allow" icon="circle-check">
    The agent uses it without asking. This is the default for **reading** — looking things up, pulling data.
  </Card>

  <Card title="Needs approval" icon="hand">
    The agent pauses and shows you exactly what it's about to do before it does it. This is the default for **writing** — creating notes, tasks, or updates.
  </Card>

  <Card title="Blocked" icon="ban">
    The agent can never use it, period.
  </Card>
</CardGroup>

## Sensible defaults

When you connect a tool, Rivvi starts you off safely:

* **Reads → Always allow.** Looking up a contact or pulling a report is low-risk, so it just works.
* **Writes → Needs approval.** Anything that changes data in your tool — a note, a task, an update — waits for your sign-off.

You can tighten or loosen any of these. Set them one capability at a time, or change a whole group (all reads, or all writes) at once.

## Setting permissions

<Steps>
  <Step title="Open the connector">
    **Settings → Connectors**, then select a connected tool.
  </Step>

  <Step title="Review its capabilities">
    They're grouped into read-only and write. Each shows what it does.
  </Step>

  <Step title="Choose a setting per capability">
    Pick **Always allow**, **Needs approval**, or **Blocked**. Changes take effect immediately.
  </Step>
</Steps>

## Approving a write in chat

When the agent wants to use a **Needs approval** capability, it doesn't just do it — it shows you an **approval card** in the chat that previews the exact change: which tool, which action, and the specific details. You **Approve** or **Decline**. Nothing reaches the external tool until you approve.

<Note>
  Your permission settings are enforced on Rivvi's servers, not just in your browser. A capability you've blocked stays blocked no matter what — the settings you see are the real gate.
</Note>

## Muting vs. disconnecting

Two different things:

* **Mute** (a switch in the chat's **+** menu) temporarily hides a connected tool from the agent for your current browser. Your credentials and settings stay intact — it's a quick "not right now."
* **Disconnect** (in Settings → Connectors) removes your stored credentials for the whole organization. Your permission choices are remembered, so reconnecting later is quick.

## Next

<CardGroup cols={2}>
  <Card title="Using connectors in chat" icon="messages" href="/connectors/using-connectors-in-chat">
    See how the agent puts a connected tool to work.
  </Card>

  <Card title="Connect HubSpot" icon="hubspot" href="/connectors/hubspot">
    The worked, end-to-end example.
  </Card>
</CardGroup>