15 · The Workbench
Tool Permission
What an agent may invoke
The allowlist or policy governing which tools an agent can call — file write, bash, browser, MCP servers, git push — and whether each needs approval.
Concrete example
Browser control enabled; production deploy tool disabled until you opt in.
Why it matters
How harnesses express the permission ladder.