Safety, scopes & privacy

Advanced  The agent is built so it can be useful without being dangerous. There’s no draft queue and no per-action approval — when you ask for something in scope, it just happens, live, in Protocol. Your control is upstream of that: the access you grant when you connect, the hard limits no agent key can cross, and your power to disconnect anytime.

Choose how much power — the access you grant

When you connect an assistant you approve it in your browser and pick how much access to grant (and you pick the same access level when you create a manual key). That single choice — not an approval prompt later — is how you decide how much an assistant can do. The three access levels are cumulative: each adds to the one before.

Most coaches use read + write (the default). Pick read only for a pure research assistant that can never touch anything; pick read + write + send only when you specifically want it to be able to reach a client (reminders) or fire an automation on demand. You can connect different apps at different access levels. There’s no “everyday vs risky” split inside a level — within the access you granted, the agent acts directly; the only gate is the access level itself.

The Claude plugin uses the same choice. Its consent screen asks you to pick an access level exactly like any other connection, and read + write is preselected. That default is right for most coaches: it covers everything except the three actions that reach a client. If you want the agent to fire appointment reminders or run an automation on request, choose read + write + send instead. You can also pick read only if you just want it answering questions, though most of what people ask for then will not be available. Whatever you pick, you can disconnect it from the AI Agent page at any time and it stops immediately. See Installing the Claude plugin for what that consent screen actually asks.

What it can never do

Some things have no tool at all for an agent key — no scope unlocks them, ever. This is the real safety floor:

So even a read + write + send key, the most powerful agent key, still cannot message a client, take a payment, delete a record, or generate with Protocol’s AI. The scope decides how much it changes; these four it never touches, because there’s no tool that does them.

That guarantee is specific to agent keys. It does not extend to a REST API key (pk_live_, created under Integrations, API keys). That key authenticates as you on every route in the platform, the same as signing in yourself: there’s no scope, and nothing above is blocked at the platform level for it. The four hold there only because the assistant chooses to treat them as policy, not because Protocol enforces them. A REST key is reachable only from Claude Code, and only if you set it up deliberately; almost no coach does. See Creating & using API keys and Installing the Claude plugin.

Data, privacy & revoking {#data-privacy}

This is the part to understand clearly before you lean on the feature.

What the agent can see. Exactly what you can see — your clients, Vault, schedule, conversations and reports — and nothing outside your account. It can’t reach another coach’s roster, and on a team it respects the same permissions your own login has.

What leaves Protocol. To answer a question, your assistant has to read the relevant data — and reading it means that data is sent to your AI provider (Anthropic for Claude, OpenAI for ChatGPT) to process the reply. That includes client information when your question is about a client. This is the unavoidable trade of using your own AI: the thinking happens on their side, so the data it thinks about goes there. Both providers, on their business and API plans, don’t use that data to train their models — but it is still processed by them, and once your assistant has it in a conversation, what happens to that conversation is governed by your account with that provider, not by Protocol.

Your responsibility, and ours. Protocol’s job is to keep this scoped, logged, and revocable, and to make the export something you opt into with eyes open. Your job — as the person who holds the relationship with your clients — is deciding it’s appropriate to run an AI assistant over their data, the same judgement you make about any tool you bring to your coaching. If your clients’ data is sensitive enough that this gives you pause, that pause is the feature working.

See your agents & disconnect. On the AI Agent page (open it from your profile menu), under Connected agents, you can:

• See every connected agent — its access level, when it connected, and when it was last used.
• Disconnect instantly — disconnect an app and it stops mid-sentence. Do it the moment a laptop goes missing or you stop using an app.
• Limit access — approve an assistant at read-only if you want it to analyse and summarise but never change anything at all.

Start read-only if you’re cautious. A read-only connection can do every rundown, analysis and summary in these guides and literally cannot change a thing. It’s the safest way to live with the feature for a week before you grant it read+write access.

Back to: AI agent overview · Connecting your assistant