One workspace.
For work your business owns.

Start an enabled agent by nameAddress an agent@Boring Daily Triage: review this queueAn owner enables Allow runs from Slack, and each requester links their Boring account. Use the agent’s exact name followed by a colon. The agent must be active and published, and your usual access and run permissions apply. in a Slack DM or @mention. Get results in the thread and follow upOne agent per threadMention Boring again in the channel thread, or reply in its DM thread. The next run gets bounded summaries of up to five earlier runs, not a full Slack transcript. A busy thread links to its active run; follow-ups are not silently queued. with the same agent when it finishes. Shared agents can add progress notesUpdates as it worksup to 3 brief notes per runThe agent can post short updates for workspace-visible agents. Updates are optional and delivery is best effort; the console keeps the run record and reports delivery problems.. Your linked Boring account determines what you can run.

Use Boring-managed with no setup: Claude Sonnet 5.5 by defaultDefault model1M-token context · 128K outputUnpinned agents and the assistant use Claude Sonnet 5.5 unless your workspace sets another default. Any agent can be pinned to another listed model., or GPT, Gemini, and Grok with no key. Lower-cost open-weight models are rolling out. Or bring your ownYour own keysAES-256-GCM encrypted at restA saved key for the model’s provider is used before Boring-managed billing. If a saved key can’t be loaded, the run stops with an error instead of quietly switching to managed billing. Anthropic, OpenAI, Google, OpenRouter, or compatible-endpoint keyCustom endpointPoint Boring at any OpenAI- or Anthropic-compatible API with a base URL and key. Models pinned to that endpoint never fall back to Boring-managed models, so a missing key gives a clear error instead..

Turn plain-language instructions into an editable agentGenerated draftThe model writes a name, instructions, and suggested tools chosen only from your workspace’s catalog. If your description implies a schedule, a schedule trigger is added. The result is always a draft.. Review the draft and explicitly publishPublishingeach publish is a numbered versionRuns use only published versions, never the working draft. Each publish saves an unchangeable version you can compare or restore, and restoring creates a new version, so history is never overwritten. when it is ready.

Delegate a task to another agent in the same workspace, wait for its result, and continue with that output. Linked runsLinked runschild wait up to 30 daysThe parent pauses while the child runs and records it as a linked run. Only published, active agents in the same workspace can be called, and cancelling a parent cancels its whole chain., depth limits, and cycle checksCycle checksmax depth 3Before a child starts, Boring checks the chain of agents above it. An agent can’t call itself or any agent already running above it, and nesting stops at three levels. keep delegation bounded.

SchedulesSchedulescron · per-trigger timezonePick hourly, daily, weekly, or monthly, or write a five-field cron in the timezone you choose. Optionally skip US federal holidays. Five failures in a row pause the schedule., webhooksWebhooksPOST /w/{agentId} → 202 { runId }Each agent gets its own URL and rotatable secret. Send the secret or a GitHub-style HMAC signature; the request body becomes the run’s input, and repeated deliveries are deduplicated., inbound emailInbound emailone address per triggerForward mail to the trigger’s own address. Filter by subject, allowed senders or domains, or require an attachment. The sender, subject, and message text become the run’s input., public formsPublic forms/f/{slug}Build a form from text, long text, email, date, select, radio, and checkbox fields, and share its link. Each submission starts a run with the answers. Sign-in can be required., app eventsApp eventsconnected-app triggersChoose an event from a connected app, such as a new message or a new issue, and the account it listens on. The event payload becomes the run’s input., Slack messagesSlack requestsDM or @mention · owner opt-inAddress a published agent by its exact name from a linked account. Requests and outcomes stay with the originating thread. Shared agents can deliver questions there; private-agent questions stay in authorized console and email channels. Boring does not read unmentioned channel history., the Chrome extensionChrome extension⌘⇧E · Ctrl+Shift+ERun an agent on the page you’re viewing, from the toolbar or a shortcut. It sends the page URL and your selected text, plus the title if the trigger asks for it, and an optional instruction., the workspace APIWorkspace APIPOST /api/workflows/agents/{id}/runsStart, list, cancel, and retry runs with a workspace API key that acts with its creator’s role. The OpenAPI document lists every operation a key can call., MCP clientsMCP clientsPOST /api/mcpBoring is an MCP server. Each agent you can access appears as a tool, signed in with OAuth or an API key. Short runs return their output directly; longer ones report their status., and other agentsOther agentsmax depth 3An agent opted in to delegation can start another agent in the workspace, wait for it to finish, and continue with its output. Nesting stops at three levels, and loops are blocked. can all start the same agent.

Build Boring into your own systems. Manage agents, start runs, and retrieve results through a workspace-scoped REST APIAPI keys60 requests/min per workspaceSend a key as a Bearer token or x-api-key header. Each key belongs to one workspace, acts with its creator’s role, and stops working if that person leaves the workspace., with an OpenAPI specOpenAPI documentGET /api/openapi.json · OpenAPI 3.1Public, and generated from the route schemas the server validates against, filtered to the operations an API key may call. Routes outside that list, including settings, reject API keys. generated from the same route schemas.

Import an OpenAPI 3.x documentOpenAPI import2 MB spec · 20 actions per toolPaste or fetch a JSON or YAML spec, then review and edit the actions before saving. The API must use HTTPS. Auth can be none, an API key in a header or query, bearer, or basic. or connect a token-authenticated remote MCP serverRemote MCPStreamable HTTP · up to 100 toolsConnect an HTTPS server over MCP’s Streamable HTTP transport with a bearer token, API key, or basic auth. Private and local addresses are blocked, redirects aren’t followed, and requests time out after 30 seconds., review the discovered actions, and attach the toolkit to the agents that need it.

Edit instructions together with live presence and cursorsLive editingone shared room per agentConditions and instructions sync in real time, showing each editor’s name, avatar, and caret. Only people who can manage the agent, its owner or a workspace owner or admin, can join.. A visible autosave fallbackAutosave fallbacksaves 750 ms after typing stopsWhile the live room is connected, edits save to the draft 750 milliseconds after you stop typing. If the room is unavailable, the editor saves over HTTP whenever you leave a field. keeps drafts editable if the live room is unavailable.

Browse first-party agent templatesTemplate library8 categoriesStarters for sales, support, finance, marketing, engineering, IT and security, HR, and data operations. Each lists the apps it expects, and a test checks every listed app against tools Boring supports. and adapt a starter agent to your team. Each starts as a private draftPrivate draftUsing a template copies its instructions and suggested schedule into a draft only you can see. No connection or action grant is attached until you add one. for you to connect, review, test, and publish.

Build an intake form with text, email, dates, and choice fields. Share its public URLSubmission limits20 per minute per form per IP · 1 MBEach answer is capped at 5,000 characters, and a retried submission isn’t counted twice. A form can require sign-in, and the submitter’s email is then recorded with the answers. and turn submissions into agent runs with the submitted context.

An interviewerDiscovery interviewat most 2 follow-up questionsIt asks about your area, role, tools, and what you would hand off, then up to two follow-ups. It returns up to three ideas with steps, required tools, gaps, and where a person stays involved. explores your recurring work, suggests directions, and turns your chosen idea into a private agent draftDraft onlyOnly ideas rated a good fit for an agent can become a draft. The draft holds instructions alone, with no connection, tool, action grant, trigger, or approval rule attached..

Grant only the read and write actionsRead or writeBoring classifies each action by its verb, such as get or list versus create or archive. An action it can’t classify is treated as a write, so your stricter write rules apply. an agent needs. The runtime enforces the list: a withheld action is never offered to the agentWithheld actionsup to 25 exact actions per appA withheld action is removed from the tool list the model sees. A call that names it anyway can’t resolve to a tool, so no request reaches the app. and cannot run. Connecting an app does not grant unrestricted access to it.

Connect several named accounts for the same app or custom integration, keep each private or shared, and pin each agent to oneAccount choiceWithout a pin, an agent uses its owner’s private account first, then shared ones, oldest first, so connecting a second account never moves existing agents. Other members’ private accounts are never used.. If a pinned account is removed or expires, the run stopsFails closedA pinned account that is missing or disconnected is never swapped for another; its actions become unavailable instead. The same rule covers app connections and custom-integration keys. instead of switching accounts.

When an agent holds a broad app grant, the assistant suggests narrowing it to the exact actions its instructions and recent successful runsRun evidencelast 3 successful production runsThe suggestion combines the instructions with the actions used in up to three recent successful production runs. It appears only for broad grants on apps with more than 25 actions. use. Each action is checked against the live catalog, and a manager applies the changeManager reviewOnly the agent’s owner or a workspace owner or admin sees the suggestion. It arrives as a review card, and nothing changes until that person applies it..

Tool access checks current connections and requester permissionsLive requester checkRuns can wait for hours, so before each app, custom-tool, or internal action, Boring rereads the requester’s workspace membership and access to the agent. A removed member’s run can’t keep acting.. Expired or revoked run accessRun access20-minute capabilityCredential access expires 20 minutes after it is issued and is rechecked on every call. Cancelling or finishing the run, or disconnecting the account, blocks the next request. blocks subsequent authorized requests.

Run calculations in a fresh, bounded sandbox. No network, credentials, packages, or host access; only that run’s output filesRun files40 files · 256 KB each · 2 MB totalCode can read, write, and list only the files its own run produced. Nothing else from the workspace or from other runs is reachable. are available. Python is standard library onlyPython runtimePyodide · 10 s CPUPython runs in Pyodide, a WebAssembly interpreter started fresh for each execution. There is no package install step, so imports such as numpy, pandas, or requests fail..

Known credential valuesWhat gets maskedreplaced with •••Exact values of stored credentials are replaced wherever they appear. Common patterns are masked too, such as bearer tokens and long key or token assignments, keeping a hint like “Bearer •••”. are redacted from returned content and errors, including secret echoes split across streaming responsesStreaming redactionIf a streamed chunk ends with the start of a known credential, Boring holds that piece back until the next chunk shows whether the full secret follows, then masks it..

TLS protects data in transit. Credentials Boring stores directly use an encrypted workspace vaultCredential vaultAES-256-GCM · fresh IV per secretModel keys, custom-tool and pack keys, and Slack tokens are encrypted before storage. Tampered ciphertext fails to decrypt instead of returning data. App OAuth tokens are held by Composio..

We never train foundation models on your content, and we never sell your data.

New agents start with every connected actionDefault policyall · writes only · noneEvery call to a connected app or custom integration pauses, as do web fetch, web search, and opening a pull request. Contained built-ins such as sandboxed code, run files, and memory never pause. waiting for approval, so loosening that is a deliberate choice. When Boring can’t tell whether an action only reads, it treats the action as a writeRead or writeGET · LIST · FIND · SEARCH · FETCH · READA connected-app action counts as a read only if its name has a read verb and no write verb, so SEARCH_AND_DELETE is a write, and so is any unrecognized name. A custom action other than GET is a write unless marked otherwise..

Press ⌘J or Ctrl+J anywhere in the web console. Ask which agents need attentionAgent healthAn agent is failing when its latest run didn’t succeed and the one before failed, needs attention after one failed or stopped run, and is degraded when its latest run succeeded with failed steps. A deliberate safety stop reads as healthy., what is waiting on a person, or where the spend went. It reads run evidence before diagnosing, sees only agents you can access, and changes nothing until you confirmProposal cardsThe assistant’s tools either read or prepare a card. Instruction edits, tool grants, new agents, runs, and approval decisions take effect only when you press the card..

Assign and reassign reviewersAssigned reviewersThe agent’s owner or a workspace owner or admin can route a gate to any workspace member, who is notified. Being assigned lets that member decide the gate, even on a private agent, and each change is recorded., set due dates and remindersRemindersdue 1 h–30 days · up to 4 remindersThe reviewer gets a due-soon reminder when a quarter of the window is left (15 minutes to 24 hours ahead), another at the deadline, then one every 24 hours, four in total at most., and choose what happens when an approval is still waiting after its due date: reject it and stop the run, or skip the action and continue.

Set approval rulesRules travel with the versionRules are part of the published agent version. Each run keeps its rules across pauses and retries. Matching Never rules block the action; Ask requires review; Allow cannot bypass tool grants or an authored human gate. Missing or incompatible values require review. for the amount, recipient, domain, or other fields of a proposed action. Apply them to connected apps and custom integrationsThe same controls for both kindsUse the same rules for Composio app actions, curated packs, and workspace OpenAPI or MCP actions. Conditions compare fields in the proposed call; they do not look up a record’s hidden values or total spending across calls. alike. Review an exception, block a matching action, or allow an eligible call within the boundaries you set.

Tell a Slack agent “ask me before sending” or add a supported amount or recipient restrictionSpecific, enforceable holdsHolds must map to fields on the agent’s granted integration actions. Amounts use the action’s declared units. Aggregate totals, delegated agents, repository actions, and arbitrary natural-language conditions are not supported.. Boring confirms the exact holds before work starts and enforces them alongside the agent’s rulesA request can add a restrictionRequest holds cannot loosen the agent’s grants, policies, or rules. They survive pauses and retries and carry into later runs in the same thread. Only the author can remove their holds for a future run; a changed action schema can require restating them.. Unsupported or ambiguous holds stop the request with an explanation.

Control who can build, run, and approveWho can do whatowner · admin · memberOnly the agent’s owner or a workspace owner or admin can change its approval policy or access settings, and each change is logged. Turning off manual runs limits Run to those same people.. Set each agent to pause before all calls, write actions only, or none. Manage individual Allow, Ask, and Never rules in the Tools tab, then publish them for future runsReviewed policy changesApproval rules are draft edits until published. Current runs keep their saved rules. An Allow applies only where the tool author permits it, never to a missing grant or an authored human gate..

Review the exact proposed action and scrubbed arguments, then approve or reject with your linked Boring accountLinked identitySlack’s request signature is checked first, within a five-minute window. The clicker must have linked Slack to a Boring account that is allowed to decide; an unlinked click is asked to link and decides nothing.. Answer supported input requests with RespondAnswer the requestOpen the request’s form and submit its required fields. A free-text thread reply does not answer a pending form. Answers are validated and permissions checked again before the run resumes., or adjust a supported call with ModifyReview the changed callSlack can edit supported schema fields. More complex requests open in the console. Both paths recheck the edited arguments against the run’s rules, so changing a value cannot bypass a hold or Never rule., directly in Slack. Complex forms link to the console for review.

Open “Change this” on a run or task. Use its evidence to propose instruction, tool-grant, or approval-rule changesConsole review, with a Slack handoffThe console assistant prepares these changes from one run’s evidence. In Slack, an eligible manager can prepare an instruction addition and open its review link in the console. Slack cannot apply or publish it. Automatic self-editing and multi-run improvement analysis are not included., review the diffA proposal you controlThe agent’s manager reviews the before and after. Rule changes that may loosen approval requirements are flagged before you save. A changed draft makes an old proposal stale, and applying a proposal never publishes it or changes a running version., and apply it to the draft. Publishing remains a separate decision; the activity record links back to the source run.

The native iOS and Android companionMobile companionYour session is kept in the device’s secure storage, and decisions go through the same API and permission checks as the web console. Approve or reject with a note, or answer typed requests; editing a call stays in the console. supports approvals, human-input requests, live runs, stop and retry, and workspace usage.

When a required detail is missing or a target is ambiguous, the agent can ask a clarifying questionAsk before guessingup to 2 automatic input pauses per runAgents are instructed to use available tools and knowledge first, then ask focused questions when still blocked. The model decides when to ask; the runtime enforces the pause and validates the answer. Questions route to an authorized requester or the configured reviewer fallback. without a prewritten pause point. Answer in Tasks or a supported Slack formRespond where the work startedWorkspace-visible Slack runs can deliver questions in their originating thread. Use Respond to complete the form; an ordinary reply cannot resolve it. Private-agent questions stay in authorized console and email channels., then continue with the human response in context.

See the agent’s permitted tools, limits, waits, retries, stops, and notification routes. The control inspectorWho decides each stopenforced · model-judged · human-decidedEach stop is labeled by who decides it. Finishing the work and matching a condition are the model’s judgment, platform limits and expired approvals are enforced, and rejections are a person’s call. The labels read the same limits the runtime uses. distinguishes enforced limits from model-judged behavior.

Numbered instructions run as an enforced plan: one step at a time, with later steps withheldStep briefingsThe agent sees only the current step’s text plus an outline of step numbers. It advances by marking the step complete with a one-line summary, and it can’t pick the step number or skip ahead. until the agent reaches them. Each step must be marked complete, with any evidence you requireCompletion requirementsup to 16 per stepA step can require a saved file with an exact title, or a tool call that reached an exact target such as a channel. It closes only on a successful receipt from this run; a summary or a proposal doesn’t count., before the next begins.

Each model turn runs as its own durable workflow step and saves a checkpointRun checkpointstored with the run · secrets scrubbedThe conversation so far, plan progress, step summaries, and recovery state. Structured runs also journal each step and every tool call’s outcome, so a takeover never repeats confirmed work. when it finishes. If the machine running an agent disappears mid-run, another picks the run up from the last completed turn instead of starting over.

When a model provider throttles or fails, eligible runs wait within a bounded windowRecovery window30 min · 12 cycles · 30 s → 5 min backoffTimeouts, throttling, and 5xx errors retry with a doubling delay that never undercuts the provider’s Retry-After. Billing and context-size errors fail at once. A lost worker is also counted as recovery, never as one of the step’s three attempts., honor its cooldown, and don’t repeat completed work. In structured runs, outage recovery never spends the attempts a step gets for real mistakes. If the provider stays down, the run ends with its saved progress and a clear reason.

Approvals and calls to other agentsChild-agent waits30 days · 24 waits per runA run waiting on another agent can park for 30 days; if the child hasn’t finished by then, the parent gets a failed result and carries on. One run allows up to 24 child waits and 24 approval waits; automatic clarifying input has its own two-pause limit. pause the run, survive restarts, and hold no capacity while they wait. An approval waits seven days by default, or a day past its due date, and an expired oneExpired approvalsreject or skip · 24 h grace · 30-day maxAt the deadline the gate follows its overdue setting: reject and stop, or skip that action and continue. Skipping never runs the action. Due dates can be up to 30 days out, plus 24 hours of grace. is never treated as approved. When the answer arrives, the run continues where it stopped.

Each scheduled occurrence is claimed under a unique key, webhook redeliveriesDelivery IDsIdempotency-Key · webhook-id · X-GitHub-DeliveryBoring also reads svix-id, X-Webhook-ID, and X-GitLab-Event-UUID. A repeat with the same ID gets the original run’s ID back. Email, Slack, form, and app-event triggers use their own event IDs the same way. that carry a delivery ID are deduplicated, and an approval decisionOne decision per gateA decision is saved only while the step is still pending. A second click, a Slack button, or an expiry that arrives later is told the task was already resolved. is written only once. A retry upstream doesn’t start a second run, and a second click doesn’t decide twice.

Reasoning, tool calls and results, approvals, agent calls, outputs, and errors are stored with a sequence number the database assigns in the same write as the event. Reconnect from the last number you sawResume cursor?since={seq} · 100 per pageThe events endpoint returns up to 100 entries after your last number, in order, and says whether more remain. The live stream takes the same cursor, so a dropped connection catches up. and the rest replays in order.

Your plan’s workspace and per-run spend limitsPlan limitschecked before every model requestEach model request is checked against both limits before it’s sent. When the next request would go over, it’s refused and the run stops with completed work saved. constrain model spend. Billed failed attemptsFailed attemptsA request that was billed but then failed is charged to the run before the next one is admitted. A request whose usage never comes back keeps its full reservation instead of being released. count toward the run ceiling before another request is admitted.

Set a per-run maximum, daily and billing-period workspace budgets, and a pause switchPause AI spendingPausing blocks every new model request in the workspace until an owner or admin resumes it in Settings → Billing.. Each model request, including the assistant, drafting, checks, and calls on your own keys, reserves against themReservationsEach request reserves its estimated maximum cost. With custom limits, Boring shrinks the output allowance, down to 64 tokens, to fit before refusing. If the budget can’t be checked, nothing is sent. before it is sent. Budgets cover Boring’s recorded model usage, not provider invoices.

Step timeStep time15 min active · 3 attempts per stepIn a structured run, each authored step gets 15 minutes of active execution and three attempts before the run stops with a reason., workflow lengthWorkflow length360 durable steps per runA run’s workflow is capped at 360 steps, and the agent stops after five consecutive failed tool calls instead of retrying forever., spendSpendper-run ceiling set by planEvery run has a spend ceiling from your plan, checked before each model request. Billed failed attempts count toward it., concurrencyConcurrency4 per workspace · 2 per agentShared permits cap how many runs execute at once. A run waiting on a person or a child agent gives its permit back., queued workQueued work64 queued · 30 min waitWork beyond the active limit waits in a bounded queue. A full queue refuses new work, and a run that can’t get capacity within 30 minutes fails with that reason., delegation depthDelegation depthmax depth 3Agents calling agents nest at most three levels deep, and a call back into an ancestor is blocked., sandboxed codeSandboxed codeno network · 1 s CPU JS · 10 s PythonGenerated code runs in a fresh isolate with no network, credentials, or host access, under a hard CPU and time limit. Output is capped at 8,000 characters., and custom-tool network accessCustom-tool network accessHTTPS only · same-origin redirectsCustom tools call HTTPS endpoints only. Private, link-local, and cloud-metadata hosts are blocked, and a redirect is followed once, to the same origin only. each have an enforced limit, so a confused agent can’t loop, flood a system, or spend without end.

A schedule pauses after five consecutive failuresSchedule circuit breaker5 failed runs in a rowOnly failed scheduled runs count; a successful or condition-ended run resets the count. When it trips, the schedule is disabled, logged in the agent’s activity and Settings → Logs, and the agent’s notification channels are alerted. until you re-enable it, giving your team time to fix the underlying problem.

Full input schemas guide tool calls. Supported format correctionsFormat correctionsBoring parses a list that arrived as a JSON string and drops a null from an optional field, and nothing else. It never changes value types or invents defaults, and an approver sees exactly what will run. and a bounded repair attemptArgument repair1 per turn · no tool runsOne model call may fix only the fields that failed validation. If any other field changes, the repair is discarded and the call stays invalid. The repair counts toward your budgets. address invalid arguments while preserving unrelated valid fields. Reviewed, version-matched tool guidance helps avoid known mistakes; inputs are checked before execution.

Built-in checksBuilt-in checksRule-based checks flag missing guardrails or failure handling, no final reporting step, an event trigger with no conditions, a write-capable agent without an approval gate, vague steps, no trigger, and broad tool grants. flag setup and instruction issues. After publication, an AI quality reviewPost-publish reviewup to 3 findings per versionEach publish triggers one review against Boring’s style rules, and unchanged instructions reuse the last result. It skips what the built-in checks cover, and each fix opens as an edit you review. can suggest fixes for ambiguity; your team reviews and applies the changes.

Try unpublished changes with a one-off draft runDraft runsA draft run uses the working version with your connected accounts and the agent’s approval policy, so writes still pause under the default. Schedules keep using the published version. while scheduled work keeps using the published version. Draft runs use real tools; Confidence checks provide recorded replay.

Confidence checks replay successful runsRecorded replayup to 20 baseline runs per checkEach tool call gets the saved response, in order. A different tool or changed arguments is blocked and flagged, and no live tool runs. Approvals are simulated, past-run memory is left out, and each replay still uses the model. against a draft with live tools blocked. Inspect changed tool calls, arguments, and approvals.

Follow steps and tool callsRun stepsone ordered record per runEach step records its type, status, tool, the read-or-write classification the approval gate used, tokens including cache reads and writes, and duration. The classification is stored with the step, so later rule changes don’t rewrite history. as they happen. Inspect retained request and response payloadsPayload retention90 days · 600 KB per stored payloadTool arguments and responses are stored with each step; a response over 600 KB is kept as a marked, truncated preview. Ninety days after a run finishes they’re cleared, while its status, output, and step list remain. from the run timeline.

Keep proposed actions, confirmed results, and uncertain outcomesUncertain outcomesintent · confirmed · unknownIn structured runs, each tool call’s intent is saved before it is sent, then settled once with its result. A call whose outcome can’t be confirmed is recorded as unknown and never counts as a successful receipt. distinct. A proposed tool callProposed callsdeferred until approvedA write waiting for approval is stored as deferred: the call returned, but the change hasn’t happened yet. Completion checks skip deferred calls and accept only a settled success for the exact target. is not treated as proof of delivery.

Recognized provider failuresFailure classesbilling · spend limit · throttling · contextBilling and spend-limit refusals stop automatic retries and ask for review. Each label reports the provider’s HTTP status and any Retry-After it sent, without guessing whose account or which limit was reached. are labeled as billing, rate limiting, or context size, with the provider’s reference IDReference IDAI Gateway log ID or provider request IDThe first available ID from the failed model response is saved with the run error: the AI Gateway log entry, then the provider’s request ID, then the Cloudflare ray ID. Paste it into a log search or support ticket. ready to copy. A deliberate safety stopSafety stopdestination verificationWhen a step must verify that its target exists and the agent can’t confirm it, the actions that depend on it are blocked and the run stops. It reads as a safe stop and doesn’t count toward the agent’s failure streak. is flagged as a safety stop, with guidance, instead of reading like an error.

Settings → LogsOperations log6 categories · 3 severities · 30 daysFilter by trigger, run, approval, integration, delivery, or quota, and by info, warning, or error. Any member can read it, limited to agents they can access. Only the backend writes entries. explains why scheduled or email-triggered work didn’t start: a skipped schedule, a filtered email, a blocked run, or a schedule paused after repeated failures. Entries are kept for 30 days. It is an operations log, not a complete audit log.

Owners and admins see usage by person, trigger, and agentUsage breakdown7, 30, or 90 days vs. the prior periodSpend and run counts for finished production runs, grouped by the member who started them or, for automated runs, by trigger. Assistant, drafting, and review model calls are reported separately, and models get their own breakdown., and compare per-run costs.

Download summaries of an agent’s latest 100 runsRun exportGET /api/workflows/agents/{id}/runs/exportEach row has the run ID, status, trigger, creation time, duration, input and output tokens, cost, and error. CSV is the default, JSON adds returned and total run counts, and workspace API keys can call it too. for reporting and review, with a note when older runs are left out. Retained tool-call payloads remain inspectable in the console.

Review the agent’s activity timelineAgent activityappend-only · kept for the agent’s lifetimeEntries are only ever added, never edited or deleted by the app, and go away only with the agent. Coverage includes renames, sharing, model, tools, knowledge, triggers, memory clears, publishes, restores, and reviewed draft changes. Older standing-approval events remain in history. for recorded changes to permissions, tools, triggers, knowledge, and published definitions, with the actor and before-and-after context.

Every version stays a diff you can review and roll backRollbackrestore creates “Restored from vN”Restoring an old version copies it into a new published version, so history is never rewritten. Unpublished draft edits stay in place, and the restore is logged in the agent’s activity with who did it.. Export definitionsPortable exportAgent Skills SKILL.md or JSONDownload an agent as Agent Skills markdown or a JSON file with its instructions, model, tool grants, approval policy, and triggers, without secrets. Import accepts either file, or any Agent Skills SKILL.md. and move between workspaces without secrets.

Recent run outcomes surface degraded or failing agentsAgent healthfailing = two failed runs in a rowAn agent reads degraded when its latest run succeeded but recovered from failed steps or stopped short of its plan’s last step. One failed latest run needs attention, and safety stops never count as failures.. Configured notificationsNotification routesin-app · email · both · none, plus SlackEach agent routes run failures, approval requests, and approval timeouts in-app, by email, both, or nowhere, and Slack is a separate switch. A background run blocked before starting notifies the owner in-app. bring failures, blocked runs, and approval requests to your team.

Opted-inRecipientsoff by default · owners and adminsAny member can turn the digest on in their profile, but only workspace owners and admins receive it. A workspace with no activity this week or the week before is skipped. workspace owners and admins receive an email and in-app recapDigest contentsMondays 08:00 UTC · previous Mon–Sun weekRuns with successes and failures, tool calls, agent run time, files and artifacts produced, approvals decided and still open, alert notifications, and total spend, plus the top five agents and top three tools. of runs, outputs, approvals, and spend, with week-over-week context.

Index individual web pages, RSS, text, and filesFile uploadsPDF, Word, text, CSV, HTML, JSON · 4 MBUpload PDF, Word, plain text, Markdown, CSV, HTML, JSON, RTF, or OpenDocument text files up to 4 MB each. Uploaded files and pasted text don’t change, so they’re indexed once. into searchable knowledgeKnowledge search8 results by default · up to 50Each workspace gets its own search index. An agent searches workspace-wide sources plus the ones added to it, and a search that can’t finish within 30 seconds fails rather than returning partial results.. Re-sync supported web sources on a scheduleRe-sync cadencepages daily or weekly · RSS 15 min to dailyWeb pages and RSS feeds are re-fetched on the cadence you pick, or only when you click Re-sync. Each fetch must answer within 20 seconds and stay under 4 MB..

Load and inspect fully rendered public pagesPage modesmarkdown · links · elementsRead a page as Markdown with its accessibility tree, list its links, or extract up to eight CSS selectors. Pages load in a real browser with a 30-second limit and can wait for a selector to appear. with native browser capabilitiesBrowser boundary20 fetches per run · 192 KB per resultNo cookies, logins, custom scripts, or headers, and private addresses are blocked, even after a redirect. The agent opts in with a [Web fetch] line, and each fetch follows its approval policy., without configuring an external browsing tool.

Eligible completed runsEligible runssuccessful production runsEvaluation runs, sub-agent runs, failed or cancelled runs, and runs already at their spend ceiling don’t reflect. Reflection uses the run’s own model, and its cost is added to that run. can turn experience and your feedback into lessonsLesson limits3 new per run · 24 active per agentEach reflection adds at most three lessons, deduplicated against what the agent already knows. At 24 in-force lessons, a new one must replace an old one. Lessons from your feedback apply at once, even in review mode. for future runs. Every lesson links to its source. Set inferred learning to automatic, review-first, or offLearning modesauto · review · offAutomatic applies inferred lessons immediately. Review-first holds them until someone approves them on the Memory tab. Off stops runs from writing facts, lessons, or recaps; you can still add memory by hand..

Read and edit files from repositories named in the agent’s instructionsRepository allowlist[Repository: owner/name]Only repositories written into the published definition are reachable, whatever the model asks for. A checkout copies just the paths requested, within the run’s 40-file, 2 MB limit, with no clone or local git history., then open a GitHub pull requestPull requestsnew branch on the base’s current headEdited files are committed to a new branch through GitHub’s API, on top of the base branch’s latest commit, then opened as a pull request for review. for review. Publishing changes is approval-gated; tokens stay on the platformRepository tokenfine-grained: Contents + Pull requestsAdd a token in Settings → Repositories. It’s resolved from the vault for each request, never supplied by or returned to the model, and never stored on a run step..

Collect the CSVs, JSON extracts, charts, and other files an agent createsRun file limits40 files · 256 KB each · 2 MB per runAgents write text or base64 binary files from a tool call or from sandboxed code, such as CSV, JSON, Markdown, PDF, PNG, SVG, and ZIP. Files are deleted 90 days after creation. in one place on its run.

Saved factsSaved facts2,000 characters per factThe agent saves facts with its memory tool, or you add them on the Memory tab. Sensitive personal topics and credential-shaped content stay out of automatic memory; an owner can opt in to sensitive topics, never to credentials., recent-run recaps, and lessons give the next run contextWhat the next run sees20 facts · 12 lessons · 5 recapsEach run’s prompt carries the newest active facts and lessons and recent-run recaps, each under its own character budget, so memory can’t crowd out the task. Pending and switched-off entries are never injected.. Inspect, manage, or download the agent’s memory as JSONMemory exportfacts and lessons · every statusThe download includes every fact and lesson, including pending, switched-off, and archived ones, with its source and originating run. Run recaps stay on their runs, and attached knowledge isn’t included.; learning updates its context, not the underlying model.