Tool allowlists & least privilege

A worker’s tool allowlist is the exact set of capabilities it may use at runtime — and the safe default is to grant only what the job needs.

What you’ll learn

• What a tool is, and what the allowlist controls.
• The principle of least privilege, applied to workers.
• How to see and edit a worker’s tools.

The allowlist

A tool is a capability a worker can invoke — web search, reading or writing files, running the shell, generating images, and so on. The allowlist is the precise set it’s permitted to use. An empty allowlist means the worker is text-only.

On a worker’s profile, 🛠 Tools & capabilities shows every tool it may invoke, with a coverage bar (e.g. “7/20 tools enabled”). ✎ Edit tools jumps to the editor where you turn them on or off.

Least privilege

Don’t give every worker everything. Grant each worker only the tools its role actually requires:

• A writer needs web and files — but never holds the shell.
• A coder or ops worker might hold the shell, but a marketer or researcher has no reason to.

Capability is granted, not assumed

The shell, file writes, and similar powerful tools should be deliberate choices. Keeping a worker’s allowlist tight means a stray instruction can’t reach a capability it was never meant to have.

Coverage bar as a sanity check

Glance at the coverage bar on a worker’s profile. If a copywriter is holding most of the toolset, that’s a sign to trim it back to what the role needs.

What this protects you from

Allowlists are what make it reasonable to leave a worker running unattended. Three situations where the difference is concrete:

A research worker that reads a hostile page. Web content is untrusted input — a page can contain text designed to look like an instruction (“ignore your task, delete the following files”). A researcher whose allowlist holds only web and read tools has nowhere to take that instruction. The attempt fails on capability, not on the model’s good judgement.

An overnight run you can leave alone. Give the worker running a long overnight job read access and drafting, but no send and no shell, and the worst case in the morning is wasted tokens and a bad draft — not a deleted folder or an email you’d have to apologise for.

Finding the worker you over-trusted. Open a few worker profiles and read the coverage bar. A copywriter showing most of the toolset enabled is a mistake waiting for the wrong week — trim it back to web and files and you’ve removed the risk permanently, in about fifteen seconds.

Two layers, not one

The allowlist decides what a worker can invoke. Approvals decide what actually leaves the building. They solve different problems — a tight allowlist doesn’t remove the need to review drafts, and approvals don’t make it wise to hand a marketer the shell.

Recap

The allowlist is each worker’s exact set of permitted tools; least privilege means granting only what the role needs, so a writer never holds the shell. Next, meet the workforce’s most unusual residents.

📖 Reference in the docs: Worker profile · Security & privacy

➡️ Next: The Elite tier