Give an agent tools
Attach tool groups, bind account connections and choose approval rules for each action.
Give an agent the actions it needs for its job. A tool grant and a usable account connection are separate requirements.
Before you begin
You need owner or dashboard editor access to change tools. Connect service accounts in connected accounts. App attachment requires permission to manage apps.
Attach and bind tools
- Open the agent's Connections tab.
- Select the plus node for tools and choose a tool group.
- Open the attached group's node.
- Choose its Workspace account for a connected service, or Credentials for this agent for a custom tool requiring secrets.
- Resolve any missing permissions or expired authorization shown for that connection.
- Set the approval policy for each action under Tools & approval policy.
- Test a representative task in Chat.
Bindings belong to each tool group on this agent. For example, bind Gmail to sales@ and Drive to ops@; actions within a group use that group's account. Several agents can reuse an account-owned connection or credential profile.
Watch out — A tool requiring a connection cannot run without a valid binding. Agents never fall back to the member's personal account. Use Ask for powerful or destructive actions until you trust the behavior.
Choose approvals
| Policy | Effect |
|---|---|
| Auto | Runs without stopping for the per-tool approval |
| Ask | Pauses for a person to approve |
| Off | Cannot run |
The All control applies one policy to the group's actions. A recommended policy is a starting suggestion, not a permanent rule. Independent delivery or safety approvals still apply, including file transfers to external tools.
Runs automatically, without stopping
Pauses and waits for a person
Never runs, in any context
Attaching Slack or WhatsApp grants tools; incoming messages trigger subscribed workflows separately. See workflow triggers.
Attach an internal app
- Select the App plus node in Connections.
- Choose the app roles and a published app. Older apps use Viewer for reading or Editor for changes.
- Open its node to review or change the roles.
- Set the approval policy for each app tool under Tools & approval policy.
- Use Open app access to review the same binding in the app, or Detach from agent to remove it.
The agent's app roles determine which tools appear. The requesting member's own app access also applies. Choose at most eight app roles.
App tools take Auto, Ask or Off like other tools. Until you change them, reads run automatically and changes ask first. The policy belongs to the agent, so it is the same whoever asks. Detaching the app removes its policies.
Agents can also read files stored in the app, such as uploaded PDFs, scans or spreadsheets: they save a copy in their Workspace downloads and read it there. The app permissions and the policy of the app tool that returns the file apply.
A paused, suspended, unpublished or trashed app supplies no tools. An inactive agent cannot use them either. The binding remains visible until it becomes available again or you detach it.