Safety classes & the consent law

Every tool carries a machine-readable safety class, and the consent law makes what an agent creates Private by default. This is the governance that makes building on and connecting to The Cloud trustworthy.

Read as Markdown

Governance is not fine print on The Cloud — it is the product. Every tool is classified, and consent is a floor the platform enforces, not a setting a builder can opt out of. This is what lets an owner connect any AI, or install any app, without handing over the keys.

The safety classes

Each tool advertises a machine-readable class that mirrors the MCP annotations the server returns, so a client can plan around it before calling anything. The classes are shown on every tool in the tool reference.

read — reads only. Mutates nothing and reaches no external system.
write — creates or changes workspace state and hands back a link.
destructive — deletes or sends. Not reversible by re-calling; the client confirms first.
consent — widens exposure (share, publish, visibility). Needs the owner's explicit per-action approval.
external — reaches a system outside The Cloud (Gmail, GitHub, Calendar, Telegram, Spotify, Amazon).

What an agent creates is Private by default. Widening exposure — sharing, publishing, or any change that makes something more visible — and every destructive or irreversible action needs the owner's explicit, per-action approval. An agent cannot self-approve: it can request the change, but it only takes effect once the owner confirms it in The Cloud.

Note

One asymmetry

Making something more private applies immediately — locking down never needs ceremony. Making anything public always waits on the owner's approval.

Why builders should trust it

Scoped by manifest. A Studio app reaches only what its manifest requests and the owner grants — deny by default, brokered through a single choke point.
Classified end to end. The same classes govern a connected AI and a hosted app, so the safety story is identical on both golden paths.
Honest provenance. Every artifact an AI authors here is signed with its role, model, and surface — so what acted, and as what, is always visible.

The safety classes

read — reads only. Mutates nothing and reaches no external system.

write — creates or changes workspace state and hands back a link.

destructive — deletes or sends. Not reversible by re-calling; the client confirms first.

consent — widens exposure (share, publish, visibility). Needs the owner's explicit per-action approval.

external — reaches a system outside The Cloud (Gmail, GitHub, Calendar, Telegram, Spotify, Amazon).

The consent law

Note

One asymmetry

Making something more private applies immediately — locking down never needs ceremony. Making anything public always waits on the owner's approval.

Why builders should trust it

Scoped by manifest. A Studio app reaches only what its manifest requests and the owner grants — deny by default, brokered through a single choke point.

Classified end to end. The same classes govern a connected AI and a hosted app, so the safety story is identical on both golden paths.

Honest provenance. Every artifact an AI authors here is signed with its role, model, and surface — so what acted, and as what, is always visible.