How building works
The definition is the thing that runs. There is no second, hidden version.
The steps you see on the canvas are not a picture of the agent. Attaching a tool to a step is the same act as granting that permission at runtime: the graph is read to produce the permissions the runtime enforces, so the two cannot drift apart. A node that did nothing could not exist, because nothing would read it.
An edit is a proposal, not a save. The model proposes a whole new definition, the product works out what changed and whether any of it widens what the agent may do, and you confirm. The change is applied against the revision it was made from, so two people editing at once cannot quietly overwrite each other.
A narrow agent only ever gets the services you named. Asking for something outside them is refused rather than quietly granted.
Publishing freezes a version. Versions are immutable — the database refuses to update or delete one — so a run can always say exactly which definition produced it. A published agent is private to you or visible to your workspace. There are no anonymous public agent URLs.
- Most steps
- How many times it may act before it must stop.
- Most tokens
- A ceiling on the thinking, per run.
- Gives up after
- Active working time, not wall clock. A run waiting on you is not spending it.
- Spend cap
- The most one run may cost before it is stopped.