# Give an agent tools

> Attach tool groups, bind account connections and choose approval rules for each action.

Give an agent the actions it needs for its job. A tool grant and a usable account connection are separate requirements.

## Before you begin

You need owner or dashboard editor access to change tools. Connect service accounts in [connected accounts](/en/docs/tools/connected-accounts). App attachment requires permission to manage apps.

## Attach and bind tools

1. Open the agent's **Connections** tab.
2. Select the plus node for tools and choose a tool group.
3. Open the attached group's node.
4. Choose its **Workspace account** for a connected service, or **Credentials for this agent** for a custom tool requiring secrets.
5. Resolve any missing permissions or expired authorization shown for that connection.
6. Set the approval policy for each action under **Tools & approval policy**.
7. Test a representative task in **Chat**.

Bindings belong to each tool group on this agent. For example, bind Gmail to sales@ and Drive to ops@; actions within a group use that group's account. Several agents can reuse an account-owned connection or credential profile.

> **Watch out** — A tool requiring a connection cannot run without a valid binding. Agents never fall back to the member's personal account. Use **Ask** for powerful or destructive actions until you trust the behavior.

## Choose approvals

| Policy | Effect |
| --- | --- |
| **Auto** | Runs without stopping for the per-tool approval |
| **Ask** | Pauses for a person to approve |
| **Off** | Cannot run |

The **All** control applies one policy to the group's actions. A recommended policy is a starting suggestion, not a permanent rule. Independent delivery or safety approvals still apply, including file transfers to external tools.

Attaching Slack or WhatsApp grants tools; incoming messages trigger subscribed workflows separately. See [workflow triggers](/en/docs/workflows/triggers).

## Attach an internal app

1. Select the **App** plus node in **Connections**.
2. Choose the app roles and a published app. Older apps use **Viewer** for reading or **Editor** for changes.
3. Open its node to review or change the roles.
4. Set the approval policy for each app tool under **Tools & approval policy**.
5. Use **Open app access** to review the same binding in the app, or **Detach from agent** to remove it.

The agent's app roles determine which tools appear. The requesting member's own app access also applies. Choose at most eight app roles.

App tools take **Auto**, **Ask** or **Off** like other tools. Until you change them, reads run automatically and changes ask first. The policy belongs to the agent, so it is the same whoever asks. Detaching the app removes its policies.

Agents can also read files stored in the app, such as uploaded PDFs, scans or spreadsheets: they save a copy in their Workspace downloads and read it there. The app permissions and the policy of the app tool that returns the file apply.

A paused, suspended, unpublished or trashed app supplies no tools. An inactive agent cannot use them either. The binding remains visible until it becomes available again or you detach it.

## Related

- [Connected accounts](/en/docs/tools/connected-accounts)
- [Custom tools](/en/docs/tools/custom-tools)
- [App access](/en/docs/apps/access)
- [Built-in capabilities](/en/docs/agents/capabilities)