Capabilities and permissions

Grant the workflow the account, tools, and runtime capabilities required for its task.

A workflow declaration specifies which capabilities it intends to use. The deployment still checks the authenticated actor, Flow ownership, selected account, and current authorization when admitting and executing work.

Connections

Connector owns external credentials. A node selects a Connection rather than embedding its access token in a Revision. Two accounts for the same service remain separate authorities; a failure on one account does not grant permission to fall back to another.

A Flow’s shared access configuration is separate from its graph. Publications and Runs fix the required authorization identities and snapshots. Upstream revocation can still prevent a later call.

Agent tools

An Agent can call only its declared tools. Tool declarations select the Action or workflow, account, fixed parameters, model-provided parameters, and approval policy. The model cannot expand these permissions by writing a prompt.

The Agent node and Connector node describe these choices.

Code capabilities

Code runs in an isolated environment. Built-in modules do not grant access to host files, credentials, or arbitrary networking. External Actions, workflow calls, and HTTP hosts must be declared through the supported capability interface.

Variables and sensitive data

Variables are account-owned configuration. They avoid placing literal values into the workflow definition, but user code can still return, log, or transmit values it receives. They are not a non-exportable secret mechanism.

Only pass data and permissions that the current task needs. Inspect outputs and logging when a workflow processes sensitive values.