"Report this week's orders, email the supplier, put the meeting on my calendar" — your agent runs it with 50+ built-in tools. Every risky step queues for your approval; nothing critical ever runs silently.
Read/prepare tools (T1) are side-effect-free and run freely; write/send tools (T2) require approval according to your autonomy level.
Reads, researches, drafts; generates Word/PowerPoint/Excel and images — never writes to your systems.
Sends, writes, updates — queued for approval based on risk.
Google (Gmail, Calendar, Drive), Microsoft, Notion, Postgres/MySQL/MSSQL — credentials live in an encrypted vault, never reach the LLM.
Just say "put the invoices from [email protected] into Drive under Invoices > Company > Month": the agent searches the mail, pulls attachments through a safe quarantine (raw file bytes never enter the model) and uploads them into foldered Drive paths — creating folders as needed. It also reads the text inside the attachment: PDF, Word, Excel, CSV — and because OCR kicks in on scanned PDFs, it can pull the amount off an invoice that is nothing but an image. All file operations in one turn are collected into a single approval card. Turn it into an autonomous task to run every month by itself.
Just say "work out what I paid in invoices in 2026 and save it as an Excel sheet in the xyz folder on Drive": the agent reads the mail, does the maths, generates the sheet and puts the file it generated straight into Drive (the upload comes to you for approval). Same for decks: it reads a Drive folder, builds the deck and drops it back in the same folder. The limit: the one-click Drive connection lets the agent see only the files and folders it created itself — so let it create the target folder, or put a fully-scoped Google identity in the Vault.
Add your MCP server; the agent auto-discovers your tools and routes them through the same policy engine.
Read Instagram/X/TikTok/Reddit; publish to connected accounts with approval (social_post). A 6,000+ document expertise template teaches platform rules.
You decide how much to trust. Every tool call is evaluated before it runs: capability gate → allow-list → risk class → approval threshold. This is code-level enforcement, not a prompt rule — prompt injection cannot override it.
email_send(to: [email protected]) ① capability ✓ T2 enabled ② allow-list ✓ example.com listed ③ risk medium (external send) ④ autonomy supervised → ceiling: safe → DECISION: ASK APPROVAL
Three memory layers: your profile, episodic history ("last week's campaign work"), and rules distilled from your corrections. Schedule tasks in plain language, get a timezone-aware morning briefing, and let Shopify webhooks trigger the agent instantly.
Good morning, 3 things today: 1. 2 PM supplier call — yesterday's price list summarized, attached. 2. Campaign orders up 18% (47 y'day). Stock: Trail-X critical. 3. You told Ali "I'll reply today" — draft ready, just approve.
Type 'summarize this week's orders' - the agent handles the rest and asks you before anything risky.
Start free