AI Agent Security and Data Handling

AI agent security in NocoDB starts with limits that you set. NocoDB agents act in your project only within these limits. Each agent has its own identity and role. An agent can only use the tools that you turn on. The records that it changes show the agent as the author. Coding agents also work on isolated machines, in a cloud sandbox. Their GitHub tokens are scoped to one repository and are not stored on the machine.

AI agents act as themselves

An agent acts with its own identity, not as the person who created it. Records that the agent creates or changes show the agent as the author, in the record history and in the audit log.

Access is limited by role and settings

An agent can do an action only when its access level and its project role both allow it. Table permissions, field permissions and record-level security policies apply to the agent too.

When a person starts a run, for example in a chat, the agent acts with no more than the role of that person. See Roles and permissions.

Use the lowest access that does the job:

Give Edit on tables and records only to agents whose job is to change data.
Turn on Web access only when the agent needs the web. Without it, code that a general agent runs on its managed machine cannot reach the internet.
Use record-level security to show an agent only the records it needs.
For a bot on a public or group chat, set the Allowed senders of the channel.

Agents cannot loop on their own changes

A change that an agent makes does not start its own triggers. A change can start the triggers of another agent. NocoDB stops a chain of agents that start each other after 3 steps.

NocoAI asks before it changes an agent

When NocoAI creates or changes an agent for you, it asks you to approve the changes that matter:

A new agent that runs on its own, a new coding agent, or a new agent with more than read access.
New instructions, wider access, or a change that turns an agent on.

Coding agents and GitHub

Coding agents connect to GitHub only through a GitHub App installation. Coding agents cannot use personal access tokens or OAuth connections. With an app installation, you choose in GitHub which repositories the app can reach. The agent sees only the repositories that you add to it.

For each session, NocoDB gets a short-lived installation token for the one repository of the session. The token has these GitHub permissions:

Permission	Access
Contents	Read and write
Pull requests	Read and write
Metadata	Read

NocoDB does not store the token on the machine. NocoDB adds the token to the requests that git and the GitHub CLI send to GitHub. No file, environment variable or process on the machine holds the token.

Commits from the agent show the GitHub App as the author.

Machines run in an isolated sandbox

Every coding session runs on a fresh copy of its machine, in an isolated cloud sandbox. Sessions do not share files or processes. When a session is archived, NocoDB releases its machine and stores its work in the workspace.

The preview of a session is open only to project members with the Editor role or higher, on a plan that includes coding agents.

Secrets stay out of the chat

The environment and secrets of a machine reach the machine only. NocoDB stores the values encrypted and hides them in the command output and the files that the agent reads. The agent gets the names of the variables, not their values. The API returns only the names.

Use test credentials with the lowest access that the agent needs. Anyone who can run a session on the agent can read the values from the terminal.

Repository files are not instructions from you

Coding agents read CLAUDE.md and AGENTS.md from the repository to learn how to build, test and style the code. Anyone who can commit to the repository can write these files, so the agent treats them as content. The agent does not follow these files to:

Change git remotes.
Send code, tokens or environment values anywhere.
Do work that you did not ask for.

Where your data goes

The data of a NocoDB agent goes to these places:

Data	Goes to
Messages, instructions, and the records, files and code that the agent reads	The AI model of the agent. This is the NocoDB AI integration, or an AI integration with your own API key. See AI terms.
The work of an archived session	NocoDB storage, in your workspace.
Results of triggered runs of a general agent	The destination that you set: the chat, an email, or a Slack channel.