Administrators control exactly which tools are available, and to whom, from the Admin console.
Every tool can be switched on or off, and access can be limited by role. This is how an administrator decides, for example, that only senior staff may delete records or run code, while everyone may read and search.
Tool categories
Each tool carries a category that signals how powerful it is. The system detects these automatically, and an administrator can override them.
| Category | Meaning | Examples |
|---|---|---|
| Read Only | Reads data only, never changes anything. | Read a document, list documents, search. |
| Write | Creates or changes data. | Create a document, update a document. |
| Read & Write | Both reads and changes data. | Mixed-purpose tools. |
| Privileged | Elevated actions that need extra care. | Delete a document, run code, run a database query. |
Per-tool settings
| Setting | What it controls |
|---|---|
| Enabled | Whether the tool is visible to assistants at all. |
| Category | The tool's sensitivity level, used for bulk policies. |
| Role Access Mode | Allow All makes the tool available to every assistant user. Restrict to Listed Roles limits it to chosen roles. |
| Allowed Roles | The roles permitted when access is restricted. |
How an administrator manages tools
One at a time: open the tool in the Admin console and toggle it on or off. Changes take effect immediately.
In bulk: select a category (such as all Privileged tools) and an optional pack, then enable or disable everything that matches in one action.
By role: set a tool to "Restrict to Listed Roles" and add the roles allowed to use it.
The visibility chain
A tool appears to a user only if all of these are true, in order: the capability pack is on, the tool is enabled, and the user's role is allowed. Turn off a pack and all its tools disappear at once, regardless of individual settings. Administrators always retain access to every enabled tool.
Recommended policy
Restrict the privileged tools (delete, run code, database query) to a small set of trusted roles.
Leave read and search tools open to all assistant users.
Review tool access periodically as part of your normal access review.