How do you control what an agent is allowed to do?
An agent that can only read is a different risk from one that can send. PROMIVO makes that distinction explicit rather than leaving it to the prompt, and the setting is visible before you deploy anything.
In questa guida
How are actions classified?
Three tiers. READ may only read and can change nothing. WRITE may send, post and update records. DESTRUCTIVE may also delete. Every tool an agent can call is classified, so the tier is a property of the action rather than a promise in the instructions.
What does the ceiling actually do?
Each agent version carries a maximum tier it may perform on its own, and anything above it does not happen. The attempt is blocked, recorded with the exact arguments it was about to use, and shown on the run as held for approval; the agent is told the action was not performed and carries on without it. An agent set to READ can therefore tell you what it would have sent, but nothing leaves your account.
Where do I see what an agent can reach?
On its detail page, before deploying. It lists the tools it may call and the integrations it requires. An agent cannot reach a system you have not connected, and connecting one is an explicit step.
What stops a run going on forever?
Each agent version has limits: a maximum number of steps, a maximum number of tool calls, a token ceiling for the run, and a timeout. They bound a single runaway run — which the plan allowance cannot, because a plan is a monthly budget and a runaway run happens inside one afternoon.
Can I approve a held action so that it runs?
Not today. A held action is a stop, not a queue — you can see what it was going to do, but there is no button that releases it, and the run has already finished by the time you read it. If you want that action to happen automatically, the honest fix is to raise the agent's ceiling deliberately rather than to approve one case at a time. We would rather say this plainly than describe an approval inbox that does not exist yet.
Is there a record of what an agent did?
Every run stores its input, its output, its step log and the tokens it used, and every tool call appears as a step with its risk tier. Separately, the account audit log records the things people do — connecting an integration, granting an agent, changing a workflow, issuing an API key — with who did them and when.
Can I change the ceiling after deploying?
The ceiling belongs to the agent version. Changing it publishes a new version rather than mutating the one that has already run, so the record of what a past run was permitted to do stays accurate.