---
title: "Agent Tasks: permissions and credentials"
description: Understand tool grants, pinned resources, secret handling and customer-called task boundaries.
canonical: https://www.proxyai.app/docs/agent-tasks-permissions
last-updated: 2026-10-19
---

> For the complete documentation index, see [llms.txt](https://www.proxyai.app/llms.txt). Request public content pages with `Accept: text/markdown`.

# Agent Tasks: permissions and credentials

## Tools are explicit grants

A task's manifest lists the tools it may call. Each grant describes the access and bindings allowed for that tool, such as a pinned spreadsheet, permitted API hosts, an MCP server or an email destination. The task cannot obtain a tool merely by mentioning it in its brief.

Grant the smallest set needed for the job. A connected service makes a capability available for configuration; the task still needs its corresponding tool grant. Tool calls are checked against the run's pinned manifest and current ownership or connection requirements.

## Credentials stay behind the tool boundary

Connector credentials are stored by the platform. Merchant-supplied API and MCP secrets are encrypted before task settings and manifests are stored. Tool execution injects the configured credentials when making the allowed request; the task model is not given a credential-reading tool. The console masks saved secret values.

This separation does not make every task safe to expose to a customer. A task can read data through its granted tools and may repeat that data in an answer. Review both what it can read and where it can write.

## Customer-called tasks

A chat-callable task defines a tool name, when-to-use guidance, typed customer inputs, a per-customer allowance and a data-scope instruction. The instruction guides the model; it is not an authorization boundary.

Messaging channels use the customer's channel identity. Website visitors must have a verified signed-in identity before starting a customer-called task. For a custom website, follow the identity-signing setup shown in the dashboard; do not place the signing secret in browser code.

Customer-called tasks cannot use Crawler or Web search. Their memory is separated by customer, and email destinations are restricted to the caller or account owner. Answers to the caller are screened for disclosure; a held answer waits for review instead of being delivered automatically.

Do not grant a customer-facing task access to information it should never reveal. Review [execution and approvals](https://www.proxyai.app/docs/agent-tasks-execution) for how held responses and writes are handled.

## External assistants using MCP

An external assistant's OAuth scopes are separate from the tools inside an Agent Task. MCP read access does not permit task execution. Write access still requires explicit authorization for actions, and the connector accepts only its supported report recipes. It refuses arbitrary credentials, additional tools and modified recipe implementations.

Read the [MCP documentation](https://www.proxyai.app/docs/mcp) for supported tools and connection scope.