Docs
Ability Gate Documentation
Risk and settings
Settings
All options are on Agent Control > Settings .
Gate#
Setting Default What it does Gate enabled On The kill switch. Turn it off and agent calls are no longer checked. Scope Agents only “Agents only” gates Application Passwords, agent users, MCP STDIO and AI Client calls. “All REST callers” also gates REST calls from logged-in browser sessions. New agents start paused Off A first-time agent is denied everything until you change its mode. Off by default so existing setups keep working; recommended for new sites.
Decisions#
Setting Default What it does Default decision per risk level low: allow, medium: allow, high: approve, critical: approve What an agent without a matching rule gets. Each level can be allow, approve (hold for approval) or deny.
Approvals#
Setting Default What it does Approval expiry (hours) 24 How long a held request waits before it expires. 1 to 720. Approver emails Site admin email Who is emailed about held requests and AI budget warnings. One per line or comma separated. Email digest On Groups notifications into one email every 10 minutes per approver while requests keep arriving.
Retention#
Setting Default What it does Keep history (days) 90 How long requests, snapshots and audit events are kept. 7 to 3,650.
Limits#
Setting Default What it does Calls per agent per hour 0 0 means unlimited. Writes per agent per hour 0 0 means unlimited.
AI usage#
Setting Default What it does Site monthly token budget 0 Tokens per month for all plugins together. 0 means no budget. Per-plugin budgets are on the AI Usage screen.
Who can see Agent Control and decide requests: users with the manage_options capability (administrators). Developers can change this with the ankgr_capability filter.
