# Safety classes & the consent law



> Every tool carries a machine-readable safety class, and the consent law makes what an agent creates Private by default. This is the governance that makes building on and connecting to The Cloud trustworthy.



## Safety classes & the consent law

Governance is not fine print on The Cloud — it is the product. Every tool is classified, and consent is a floor the platform enforces, not a setting a builder can opt out of. This is what lets an owner connect any AI, or install any app, without handing over the keys.

## The safety classes

Each tool advertises a machine-readable class that mirrors the MCP annotations the server returns, so a client can plan around it before calling anything. The classes are shown on every tool in the [tool reference](/docs/tool-reference).

- `read` — reads only. Mutates nothing and reaches no external system.
- `write` — creates or changes workspace state and hands back a link.
- `destructive` — deletes or sends. Not reversible by re-calling; the client confirms first.
- `consent` — widens exposure (share, publish, visibility). Needs the owner's explicit per-action approval.
- `external` — reaches a system outside The Cloud (Gmail, GitHub, Calendar, Telegram, Spotify, Amazon).

## The consent law

**What an agent creates is Private by default. **Widening exposure — sharing, publishing, or any change that makes something more visible — and every destructive or irreversible action needs the owner's explicit, per-action approval. An agent cannot self-approve: it can request the change, but it only takes effect once the owner confirms it in The Cloud.

> **One asymmetry** — Making something more private applies immediately — locking down never needs ceremony. Making anything public always waits on the owner's approval.

## Why builders should trust it

- **Scoped by manifest. **A Studio app reaches only what its manifest requests and the owner grants — deny by default, brokered through a single choke point.
- **Classified end to end. **The same classes govern a connected AI and a hosted app, so the safety story is identical on both golden paths.
- **Honest provenance. **Every artifact an AI authors here is signed with its role, model, and surface — so what acted, and as what, is always visible.