Security and permissions
An Endue agent can only reach what you have given it, and cannot take an irreversible action without you. This page is the whole model in one place.
What an agent can reach
Section titled “What an agent can reach”An agent starts with nothing but reasoning, arithmetic, the current time, and public web pages. Everything beyond that is something you added:
| Reach | Comes from | Scope |
|---|---|---|
| A service you use | A connection you authorized and bound to this agent | That account, those operations |
| A packaged procedure | A skill bound to this agent | What the skill’s steps do |
| A server you run | A direct connection bound to this agent | That endpoint. For an HTTP server, only paths under it |
| A computer or a browser | The agent’s devices | Its endue Computer and its endue for Chrome |
| Built-in capabilities | Tool groups left switched on | Your Endue workspace |
| Facts about you | What it stored in memory | This agent only |
What it cannot reach
Section titled “What it cannot reach”- Other agents’ conversations, memory, and bindings. Agents are isolated from each other.
- Its own other threads. A conversation does not read across to another.
- Services you have not connected. There is no generic “call any API” capability. A direct connection reaches only the server you registered.
- Operations a connector does not expose. Each connector has a fixed list — see Available connectors.
- Anything on your own machine, unless you install endue Computer on it for that agent. Even then, the agent works as a dedicated user within the limits you set at install.
The gate in front of irreversible actions
Section titled “The gate in front of irreversible actions”Every connector operation is classified. Send (anything that leaves your account and reaches someone else) and destructive (anything that deletes or overwrites) stop and show you the exact action with the exact arguments before running.
Approving authorizes that action with those arguments, once. The next one asks again.
How credentials are held
Section titled “How credentials are held”When you authorize a connector, Endue stores the resulting token — never your password, which you enter at the provider, not in Endue. Stored credentials are encrypted, and they are used only to make the calls the connector’s operations describe.
Model-provider keys you supply under BYOK are handled the same way, and so are the header values of a direct connection. Those are never shown again after you save them, and never passed to the agent.
Withdrawing access
Section titled “Withdrawing access”| To withdraw | Do this | Effect |
|---|---|---|
| One agent’s access to a service | Unbind the connection in Agent Builder | Immediate, for that agent |
| All agents’ access | Remove the connection in Endue | Immediate, everywhere |
| Endue’s access entirely | Revoke at the provider as well | Endue can no longer call, even with a stale token |
| A shared output | Turn link sharing off | The link stops working |
For a clean break, do both the Endue side and the provider side — removing a connection in Endue does not revoke Endue’s registration at the provider.
Practical advice
Section titled “Practical advice”- Bind narrowly. The agent that drafts your emails does not need your production dashboards.
- Be careful with channel-facing agents. Anyone who can reach the bot can talk to the agent, so an agent exposed in a channel should not hold sensitive connections.
- Read approval prompts. They exist so you can catch the wrong recipient, and they name it.
- Read what you share. An output written from your mail may quote it; a share link is public to anyone who has it.
- Review memory occasionally. Agents write down what they infer, and you can delete what should not be there.