# Tools and Access

> Part of the NocoDB documentation (Agents). Index of all pages: https://nocodb.com/llms.txt. Any docs page is available as Markdown by adding `.md` to its URL.

URL: https://nocodb.com/docs/agents/tools-and-access
Last updated: 2026-10-29

Set the AI agent tools of a NocoDB agent: what it can read and change in tables, records, documents and the web, its project role and its managed machine.

<AskNocoAI>
  <Prompt>
    Let [Lead qualifier] update records
  </Prompt>

  <Prompt>
    Give [Answer bot] access to the documents of this project
  </Prompt>

  <Prompt>
    Turn off web access for [Weekly digest]
  </Prompt>
</AskNocoAI>

**Tools and access** sets the tools of an AI agent in NocoDB: what the agent can read and change. For each kind of item, you pick a level: **None**, **Read** or **Edit**. The project role of the agent sets the upper limit: an agent can only change records when its role is **Editor**.

## Before you begin

* To change the access of an agent, you need the **Creator** role or higher in the project.

## Set the agent tools and access level

1. Open the agent.
2. In the top bar, click **Settings**.
3. Go to **Tools & access**.
4. For each row, click a level.

<img alt="The Tools & access section of an agent with a level for Tables and records, Documents and Web access" src={__img0} placeholder="blur" />

NocoDB saves the change at once. It applies from the next run.

| Row                    | Levels                       | What each level lets the agent do                                                                                                                          |
| ---------------------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Tables and records** | **None**, **Read**, **Edit** | **Read** browses and queries the tables and records. **Edit** also creates, changes, links and deletes records.                                            |
| **Documents**          | **None**, **Read**, **Edit** | **Read** reads the [documents](/docs/product/docs) of the project. **Edit** also changes them.                                                             |
| **Web access**         | **None**, **Read**           | **Read** searches the web and reads pages.                                                                                                                 |
| **GitHub**             | **Edit**                     | Coding agents only. The agent reads code, pushes branches and opens pull requests in its [repositories](/docs/agents/repositories). This row is always on. |

Give each agent the lowest level that does the job. An agent that answers questions or writes reports needs **Read**. Give **Edit** only when the job is to change data, for example to triage requests or to fill in records.

Sometimes the tools of an agent were picked one by one, for example through the API. NocoDB then shows **Some of these tools were picked one by one. Choose a level to set them all.** Click a level to replace them.

## The project role of an agent

Every agent is a member of its project, with its own role. The role is **Viewer**, **Commenter** or **Editor**. An agent cannot have a higher role than **Editor**.

The **Edit** levels need the **Editor** role. When the agent has a lower role, the **Edit** option is not available and shows **Requires Editor access or higher**.

An agent that you create manually starts with the **Viewer** role. An agent from the setup chat gets the **Editor** role only when its draft changes records. See [Create an agent](/docs/agents/create-agent#review-and-turn-on-the-agent).

To change the role of an agent:

1. In the mini sidebar, click **Settings**. The project settings open at **Members**.
2. In the **All members** menu, select **Agents**. The list shows the agents with a role in this project.
3. Click the role of the agent. The role menu opens.
4. Select a new role.

<img alt="Project Members filtered to Agents, with the role menu of an agent open" src={__img1} placeholder="blur" />

An agent is a subject like a member or a team. You can use it in [table permissions](/docs/product/collaboration/table-permissions), [field permissions](/docs/product/collaboration/field-permissions) and [record-level security](/docs/product/collaboration/record-level-security) policies. For example, a policy can show an agent only the records of one region.

## What an agent can reach

An agent can do an action only when both of these allow it:

1. Its access level in **Tools & access**.
2. Its role in the project, and any table permissions, field permissions or record-level security policies that apply to it.

In a chat, the agent also acts with no more than the role of the person who chats with it. See [Chat with an agent](/docs/agents/chat-with-agent#what-an-agent-can-do-in-a-chat).

## The managed machine

Every general agent can run code on a managed machine. The agent uses the machine to work with files and data, for example to read an attached spreadsheet, convert a file or calculate a result. NocoDB sets up the machine. You do not configure it.

* The machine starts the first time the agent needs it in a session.
* Code on the machine can reach the internet only when **Web access** is on.
* The files of the agent are on the machine at every run. See [Files](/docs/agents/instructions#files).

Coding agents run on a machine that you configure. See [Machines](/docs/agents/machines).

## Good to know

* Records that an agent creates or changes show the agent as the author, in the record history and the [audit log](/docs/product/workspaces/workspace-audit).
* A change that an agent makes does not start the triggers of that agent again. It can start the triggers of another agent. NocoDB stops a chain of agents that start each other after 3 steps.

## Related

* [Roles and permissions](/docs/agents/permissions)
* [Security](/docs/agents/security)
* [Project collaboration](/docs/product/collaboration/project-collaboration)
* [Record-level security](/docs/product/collaboration/record-level-security)

---

## Related pages

- [Agents](https://nocodb.com/docs/agents.md): NocoDB agents are AI agents that work in a project: they read and change your tables, documents and code, answer in chat, and run on their own on a trigger.
- [AI Agents](https://nocodb.com/docs/agents/ai-agents.md): NocoDB is a no-code AI agent builder for business: AI agents that work on your tables and documents, answer in chat, and run agentic workflows on triggers.
- [Create an AI Agent](https://nocodb.com/docs/agents/create-agent.md): How to create an AI agent in NocoDB: describe the job in a setup chat or pick a template, then review and turn it on. NocoAI can also build it.
- [AI Agent Use Cases and Templates](https://nocodb.com/docs/agents/use-cases.md): AI agent use cases and examples for sales, customer service, marketing, operations and project management: 13 NocoDB templates to start from.
- [Instructions and Files](https://nocodb.com/docs/agents/instructions.md): Write the instructions of a NocoDB agent as a brief for a teammate, mention tables and documents with @, and attach files that the agent reads on every run.
- [AI Agent Skills](https://nocodb.com/docs/agents/skills.md): Turn on AI agent skills in NocoDB: reusable instructions from the project, workspace or organization catalog that an agent loads when a task needs them.
- [Triggers and Results](https://nocodb.com/docs/agents/triggers.md): Build an AI agent workflow in NocoDB with triggers: a schedule, record changes, comments, forms or webhooks. Send the results to chat, email or Slack.
- [Channels](https://nocodb.com/docs/agents/channels.md): Connect a NocoDB agent to a Telegram channel so people can message it outside NocoDB, and choose which messages it answers and who can reach it.