# Security and permissions

> What an agent can reach, what stops it, how credentials are held, and how to withdraw access.

An Endue agent can only reach what you have given it, and cannot take an irreversible action without you. This page is the whole model in one place.

## What an agent can reach

An agent starts with nothing but reasoning, arithmetic, the current time, and public web pages. Everything beyond that is something you added:

| Reach | Comes from | Scope |
| --- | --- | --- |
| A service you use | A [connection](/docs/connect/overview/) you authorized **and** bound to this agent | That account, those operations |
| A packaged procedure | A [skill](/docs/capabilities/skills/) bound to this agent | What the skill's steps do |
| Built-in capabilities | [Tool groups](/docs/capabilities/built-in-tools/) left switched on | Your Endue workspace |
| Facts about you | What it stored in [memory](/docs/capabilities/memory/) | This agent only |

## What it cannot reach

- **Other agents' conversations, memory, and bindings.** Agents are isolated from each other.
- **Its own other threads.** A [conversation](/docs/work/conversations/) does not read across to another.
- **Services you have not connected.** There is no generic "call any API" capability.
- **Operations a connector does not expose.** Each connector has a fixed list — see [Available connectors](/docs/connect/available-connectors/).
- **Anything on your own machine**, for runs on Endue's servers.

## The gate in front of irreversible actions

Every connector operation is classified. **Send** (anything that leaves your account and reaches someone else) and **destructive** (anything that deletes or overwrites) stop and show you the exact action with the exact arguments before running.

<Aside type="caution" title="The gate cannot be switched off">
  There is no per-agent or per-account setting that lets an agent send or delete
  without asking. In an unattended run — a [routine](/docs/automate/routines/) or a
  [channel](/docs/automate/channels/) — such an action is refused rather than performed.
</Aside>

Approving authorizes *that action with those arguments*, once. The next one asks again.

## How credentials are held

When you authorize a connector, Endue stores the resulting token — never your password, which you enter at the provider, not in Endue. Stored credentials are encrypted, and they are used only to make the calls the connector's operations describe.

Model-provider keys you supply under [BYOK](/docs/account/bring-your-own-key/) are handled the same way.

## Withdrawing access

| To withdraw | Do this | Effect |
| --- | --- | --- |
| One agent's access to a service | Unbind the connection in [Agent Builder](/docs/build/agent-builder/) | Immediate, for that agent |
| All agents' access | Remove the connection in Endue | Immediate, everywhere |
| Endue's access entirely | Revoke at the provider as well | Endue can no longer call, even with a stale token |
| A shared [artifact](/docs/capabilities/artifacts/) | Turn link sharing off | The link stops working |

For a clean break, do both the Endue side and the provider side — removing a connection in Endue does not revoke Endue's registration at the provider.

## Practical advice

- **Bind narrowly.** The agent that drafts your emails does not need your production dashboards.
- **Be careful with channel-facing agents.** Anyone who can reach the bot can talk to the agent, so an agent exposed in a [channel](/docs/automate/channels/) should not hold sensitive connections.
- **Read approval prompts.** They exist so you can catch the wrong recipient, and they name it.
- **Read what you share.** An artifact written from your mail may quote it; a share link is public to anyone who has it.
- **Review memory occasionally.** Agents write down what they infer, and you can delete what should not be there.

## Related

<CardGrid>
  <LinkCard
    title="Approvals"
    href="/docs/work/approvals/"
    description="The gate itself, and how it behaves unattended."
  />
  <LinkCard
    title="Connectors overview"
    href="/docs/connect/overview/"
    description="Connection versus binding — the core of the access model."
  />
  <LinkCard
    title="Troubleshooting connections"
    href="/docs/connect/troubleshooting/"
    description="Revoking, re-authorizing, and the wrong account."
  />
</CardGrid>