Rules and time-boxed grants

Agent Control > Rules lets you override the risk defaults. A rule has:

Field	Values
Agent	One agent, or All agents.
Match	An exact ability (namespace/name), a namespace (woocommerce/*) or a category (@category).
Effect	allow, approve (hold for approval) or deny.
Duration	No expiry, 1 hour, 24 hours or 7 days.
Note	Shown to the agent when a deny rule blocks a call.

Which rule wins#

The most specific rule wins: an exact ability beats a namespace, which beats a category. A rule for one agent beats a rule for all agents. A matching rule overrides the risk default and trusted mode. Paused agents stay denied whatever the rules say.

Grants from the request screen#

On a held request, Allow for 1 hour adds a rule that lets that agent run that ability for one hour, then expires. Always allow for this agent adds the same rule without an expiry. Use a grant when an agent has a batch of similar work: you approve the idea once instead of every call.

Hiding denied abilities#

A deny rule also hides the ability from that agent’s list of available abilities, so the agent does not waste calls on something it can never run.