Agent tools & approvals
An agent is only as dangerous as what it can touch. In Pradra Studio, everything an agent can touch is an agent tool — registered by an administrator, granted per capability, and classified by how much damage it could do. The riskiest class always requires a human signature.
The tool registry
Tools are registered at the organization level, each with a declared input and output contract (validated like any capability contract). A tool can be backed by:
- A capability — the agent asks one of your deployed models a question.
- A platform action — e.g. dataset statistics, or triggering a connector sync (credentials never pass through the agent).
- A plugin — custom logic registered through the plugin system.
Side-effect levels
Every tool declares what it does to the world, and the level dictates the control:
| Level | Meaning | Control |
|---|---|---|
read_only | Looks, never touches. | Allowed freely (if granted). |
reversible_write | Changes something undo-able. | Requires the capability's explicit opt-in. |
consequential | Changes the real world. | Always parks for human approval. No configuration disables this. |
The grant model
Registering a tool does not expose it to anyone. Each agent capability holds an allowlist of grants; a tool that isn't granted is invisible to that agent — an attempt to call it answers exactly like a tool that doesn't exist. Every call is also checked against the caller's own permissions: an agent never has more authority than the person or token that started the run.
The approval queue
When an agent reaches a consequential call, the run parks and the call
appears in the Agent approvals queue:
- Go to Agent approvals in the sidebar — every pending call in the workspace, with the agent, the tool, and the exact arguments it wants to use.
- Open the run's trace to see how the agent got there.
- Approve or reject. On approval, the exact parked call is re-checked from scratch — including your permission to approve it — and then executed. A rejection is fed back to the agent as an observation.
Nothing about the parked call can be edited between park and approval; what you approved is what runs.
Working with the registry in the Studio
- Go to Agent tools in the sidebar (admin permission required) to register and manage tools: type, contract, side-effect level.
- Grant tools to a specific agent from that capability's Tools tab.
- Watch usage in agent run traces — every call, allowed or refused, is recorded.
Next
- The loop that uses these tools: Agents.