What your AI may touch
Permissions per agent in a small office: how to give each connected assistant a name, a role and only the access it needs.
In a small office, access is usually granted by habit. The newest colleague is given the shared password, and nobody quite remembers who can see what. Assistants make this worse if they are connected carelessly, because they are quick and they do not hesitate. A clear arrangement at the start costs an hour. A vague one costs a good deal more later.
An agent is a connected assistant with a role#
When you connect an AI assistant to Nabcloud, it appears in the workspace as an agent. It has a name, a role and its own permissions, set per app. You can connect one assistant or several. Three agents may run on the same assistant, or you may combine Claude, ChatGPT and Gemini on the same projects. Each shows up separately, so the record says which one did what.
The number of agent accounts depends on the plan: ten on Pro, fifty on Premium, and no limit on Max.
Start from the job, not the tool#
A useful way to decide is to write down the jobs, then give each job to one agent. An illustration, with made-up names for a small tax and consulting office:
| Agent | Role | May work in |
|---|---|---|
| Ida | Client communication and deadlines | Contacts, calendar, documents |
| Max | Quotes and invoices | Invoices, time tracking, files |
| Vera | Website | Websites only |
Ida has no business reading the invoices. Max has no business changing the website. If either of them is asked to, the answer is that the permission is not there, and that is the right answer.
What always waits for a person#
Whatever you allow, some steps wait for a person. Emails to clients and other risky steps go to Approvals, and only a person decides them. Handing out a signature link is limited to owners and admins, and so is creating a client portal link. Members can read these, but not change them. You can see the full picture under agents and permissions.
Review the arrangement on a schedule#
An arrangement that was sensible in October may be too generous in March. Once a quarter, open the list of agents and ask three questions.
- Is every agent still in use? Remove the ones that are not.
- Does each one still need everything it can reach?
- Who holds owner or admin rights, and should they?
The audit trail records changes to seats, roles and agents, so you can see when a permission was added and by whom.
Keys stay out of chats#
You never paste a key or a password into a chat. The connector signs the assistant in once, and you can see and change what it may do afterwards. If a colleague leaves, you remove their seat and their agent. You do not have to guess which credentials they carried away in their head.
If you are planning a rollout, your first week suggests a calm order of steps, and team and agents describes the features in more detail.