How the rules work
- Rules only narrow. A role being allowed means the agent may try. The person’s own permissions still apply to every step, so an agent can never do something its asker could not do themselves.
- A refused step gets a plain answer. If someone’s role is not allowed to use a kind of tool, the agent says so for that part, for example “I can’t do that for your role. Ask someone who handles billing tasks.”, and carries on with the rest.
- Owners and managers always pass. The role lists never lock them out.
- Contacting patients needs a permission too. Texting, emailing, messaging or calling a patient through an agent also needs the person’s Contact patients through agents permission (see Permissions). Owners and managers always have it, and so does anyone whose permissions you have not set yet. Even then, nothing reaches the patient until a person approves the drafted message on its card (the only exception is an agent answering the person who just texted or WhatsApped it, on the same channel, within 30 minutes of their message), and the agent waits for that decision before it carries on: see Approve a message to a client.
- Every refusal is recorded in your audit log, without any message text.
Until you choose, safe defaults apply
Each tool belongs to a kind of work, and each kind starts with sensible roles. Communications covers texting, emailing, messaging and calling, posting to your team, and reading, searching and drafting clinic mail. Billing, accounting, cashier, storekeeper, records and employee roles are not in it unless you add them for a tool.Choose who can use an agent
1
Open the agent
On the Agent Builder page, open the agent and select Who can use in the top bar.
2
Pick the roles
Under Who can use this agent, choose the roles. Leave it empty to let everyone use the agent. People whose role is not listed do not see the agent when they type @ or start a direct message in Team chat.
3
Adjust a tool if you need to
Under Tools, each tool shows its kind and the default roles. Choose roles to replace the default for that tool alone. Select Reset to default to go back to the default.
4
Save
Select Save. The change applies to the next thing anyone asks.
When no one is asking
Scheduled runs, webhooks and other automatic runs have no person behind them. Under When no one is asking, act as, choose the role the agent should act as. It then uses the tools that role is allowed to use. If you leave it on Choose automatically, the agent acts as the most limited role that can use all of its tools, and the screen shows which role that is. The Who can use this agent list applies to that role too.Assistants on your public website
An assistant on your public website is not limited by staff roles. You choose its Public scope instead, in Public UIs, and it gets the safe tools in each scope you tick and nothing else:
Each scope lists the tools it includes on the screen. A visitor can never see another person’s appointment, an invoice, a note or anything about your staff.
Agents you published before this was introduced now follow these rules too. Owners and managers are reminded with a notice in the app.