GuideAI agentsAI agentsiPhoneMac
Permissions and safety
What each permission means, what the defaults include, how every call is contained, and how to shut it all off in one tap.
When you approve an agent, you approve a specific set of permissions. Kept enforces them on the server, so a tool you did not grant is refused, not merely hidden from the model.
The permissions
| Permission | Lets the agent |
|---|---|
| capture | File a line the way the app does |
| tasks:read, tasks:write | Read and change tasks, steps, and comments |
| notes:read, notes:write | Read and change notes, folders, and the daily note |
| calendar:read, calendar:write | Read events and free time; create, edit, and reply |
| habits:read, habits:write | Read and change habits and groups; check in |
| goals:read, goals:write | Read and change goals and declared progress |
| memory:read, memory:write | Recall, remember, and forget |
| plan:read | Read the day's plan and briefing |
| profile:read | Your name, time zone, and life areas; also unlocks documentation search |
| health:read | Weight, sleep, mood, and metric history. Never in a preset. |
| jobs:read, jobs:write, approvals:write | Cloud Agents jobs, while that rollout is on for your account. Never in a preset. The heaviest approvals cannot be granted over MCP at all; they wait for you in the app. |
What the presets include
When an agent asks for nothing in particular, the consent page offers two one-click choices. Read and capture, marked Recommended, grants the everyday read permissions plus capture. Full organizer access adds the ordinary write permissions. When an agent names the permissions it wants, you see a checklist instead. Neither preset includes health history or Cloud Agents; an agent that wants those must ask, and you must say yes to them by name.
The same page asks whose tasks this agent creates: For me, so they are your captures and can lead your day, or Its own work, so they stay with the agent unless it asks for your help. Change the answer later beside the agent in Settings, where that control is on for your account.
How every call is contained
Each request passes through one gate that checks the tool exists, rate-limits the agent and your account, enforces the permissions you granted, strips any identity argument the model may have supplied, validates the arguments, runs the tool as you, normalizes the error, and records the outcome. There is no second path.
Tokens are short-lived, bound to Kept, hashed at rest, and rotated. If a refresh token is ever reused, Kept treats that as a sign of trouble and revokes the family. Calls are rate-limited per agent and per account, and an agent that runs hot is told how long to wait rather than cut off.
Attribution
Work an agent does is labeled as the agent's. When an agent completes a task or checks in a habit, the Record shows it as agent work waiting for you to accept, so your own completions stay yours.
Turn it off
- In Kept, Settings → Connect to your AI → Connected agents → Disconnect on iPhone, or Settings → Connect to your AI (MCP) → Set up → Connected agents → Disconnect on Mac. Immediate, server-side.
- In the agent, remove the Kept connector or server.
- In Kept, turn off Cloud AI and the tools that think go quiet; reads and typed writes still work within the permissions you granted.
What agents never see
Your password, because there is none. A Kept session token. Another person's data. Health measurements without health:read. Telemetry, secrets, or raw provider traces in a tool response; record identifiers are included so an agent can follow up on what it just read.
Next: Settings, explained.