# AI Agent Security

> Part of the NocoDB documentation (Agents). Index of all pages: https://nocodb.com/llms.txt. Any docs page is available as Markdown by adding `.md` to its URL.

URL: https://nocodb.com/docs/agents/security
Last updated: 2026-10-29

AI agent security in NocoDB: agent identity and audit, role-based access, approvals, an isolated sandbox for machines, scoped GitHub tokens and hidden secrets.

AI agent security in NocoDB starts with limits that you set. NocoDB agents act in your project only within these limits. Each agent has its own identity and role. An agent can only use the tools that you turn on. The records that it changes show the agent as the author. Coding agents also work on isolated machines, in a cloud sandbox. Their GitHub tokens are scoped to one repository and are not stored on the machine.

## AI agents act as themselves

An agent acts with its own identity, not as the person who created it. Records that the agent creates or changes show the agent as the author, in the record history and in the [audit log](/docs/product/workspaces/workspace-audit).

## Access is limited by role and settings

An agent can do an action only when its [access level](/docs/agents/tools-and-access) and its [project role](/docs/agents/permissions#ai-agent-permissions-and-guardrails) both allow it. Table permissions, field permissions and record-level security policies apply to the agent too.

When a person starts a run, for example in a chat, the agent acts with no more than the role of that person. See [Roles and permissions](/docs/agents/permissions#the-role-when-a-person-starts-the-run).

Use the lowest access that does the job:

* Give **Edit** on tables and records only to agents whose job is to change data.
* Turn on **Web access** only when the agent needs the web. Without it, code that a general agent runs on its managed machine cannot reach the internet.
* Use [record-level security](/docs/product/collaboration/record-level-security) to show an agent only the records it needs.
* For a bot on a public or group chat, set the **Allowed senders** of the [channel](/docs/agents/channels#channel-settings).

## Agents cannot loop on their own changes

A change that an agent makes does not start its own triggers. A change can start the triggers of another agent. NocoDB stops a chain of agents that start each other after 3 steps.

## NocoAI asks before it changes an agent

When [NocoAI](/docs/product/noco-ai) creates or changes an agent for you, it asks you to approve the changes that matter:

* A new agent that runs on its own, a new coding agent, or a new agent with more than read access.
* New instructions, wider access, or a change that turns an agent on.

## Coding agents and GitHub

Coding agents connect to GitHub only through a GitHub App installation. Coding agents cannot use personal access tokens or OAuth connections. With an app installation, you choose in GitHub which repositories the app can reach. The agent sees only the repositories that you add to it.

For each session, NocoDB gets a short-lived installation token for the one repository of the session. The token has these GitHub permissions:

| Permission    | Access         |
| ------------- | -------------- |
| Contents      | Read and write |
| Pull requests | Read and write |
| Metadata      | Read           |

NocoDB does not store the token on the machine. NocoDB adds the token to the requests that git and the GitHub CLI send to GitHub. No file, environment variable or process on the machine holds the token.

Commits from the agent show the GitHub App as the author.

## Machines run in an isolated sandbox

Every coding session runs on a fresh copy of its machine, in an isolated cloud sandbox. Sessions do not share files or processes. When a session is archived, NocoDB releases its machine and stores its work in the workspace.

The preview of a session is open only to project members with the **Editor** role or higher, on a plan that includes coding agents.

## Secrets stay out of the chat

The [environment and secrets](/docs/agents/machines#environment-and-secrets) of a machine reach the machine only. NocoDB stores the values encrypted and hides them in the command output and the files that the agent reads. The agent gets the names of the variables, not their values. The API returns only the names.

Use test credentials with the lowest access that the agent needs. Anyone who can run a session on the agent can read the values from the terminal.

## Repository files are not instructions from you

Coding agents read `CLAUDE.md` and `AGENTS.md` from the repository to learn how to build, test and style the code. Anyone who can commit to the repository can write these files, so the agent treats them as content. The agent does not follow these files to:

* Change git remotes.
* Send code, tokens or environment values anywhere.
* Do work that you did not ask for.

## Where your data goes

The data of a NocoDB agent goes to these places:

| Data                                                                         | Goes to                                                                                                                                         |
| ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| Messages, instructions, and the records, files and code that the agent reads | The AI model of the agent. This is the NocoDB AI integration, or an AI integration with your own API key. See [AI terms](/docs/legal/ai-terms). |
| The work of an archived session                                              | NocoDB storage, in your workspace.                                                                                                              |
| Results of triggered runs of a general agent                                 | The destination that you set: the chat, an email, or a Slack channel.                                                                           |

## Related

* [Roles and permissions](/docs/agents/permissions)
* [Tools and access](/docs/agents/tools-and-access)
* [Machines](/docs/agents/machines)
* [Workspace audit](/docs/product/workspaces/workspace-audit)

---

## Related pages

- [Agents](https://nocodb.com/docs/agents.md): NocoDB agents are AI agents that work in a project: they read and change your tables, documents and code, answer in chat, and run on their own on a trigger.
- [AI Agents](https://nocodb.com/docs/agents/ai-agents.md): NocoDB is a no-code AI agent builder for business: AI agents that work on your tables and documents, answer in chat, and run agentic workflows on triggers.
- [Create an AI Agent](https://nocodb.com/docs/agents/create-agent.md): How to create an AI agent in NocoDB: describe the job in a setup chat or pick a template, then review and turn it on. NocoAI can also build it.
- [AI Agent Use Cases and Templates](https://nocodb.com/docs/agents/use-cases.md): AI agent use cases and examples for sales, customer service, marketing, operations and project management: 13 NocoDB templates to start from.
- [Instructions and Files](https://nocodb.com/docs/agents/instructions.md): Write the instructions of a NocoDB agent as a brief for a teammate, mention tables and documents with @, and attach files that the agent reads on every run.
- [Tools and Access](https://nocodb.com/docs/agents/tools-and-access.md): Set the AI agent tools of a NocoDB agent: what it can read and change in tables, records, documents and the web, its project role and its managed machine.
- [AI Agent Skills](https://nocodb.com/docs/agents/skills.md): Turn on AI agent skills in NocoDB: reusable instructions from the project, workspace or organization catalog that an agent loads when a task needs them.
- [Triggers and Results](https://nocodb.com/docs/agents/triggers.md): Build an AI agent workflow in NocoDB with triggers: a schedule, record changes, comments, forms or webhooks. Send the results to chat, email or Slack.