App permissions

Each app you connect from Discover apps has its own permissions: how much your agents may do in it, whether Granular asks you before anything is sent or deleted, and which single actions are switched off. New apps start at Read & write with Ask me before it sends or deletes on.

These permissions apply to apps connected through Connect an app. If you have several accounts of one app, each account has its own permissions. See Connector accounts.

Open an app's permissions

1. Click the Settings button (the gear icon).
2. Click Connectors, then the Connected tab.
3. Click the app's card, for example Gmail · you@example.com.
4. Scroll to What agents can do.

Changes save as soon as you click. They apply to the agent's very next action, in every chat.

Choose what agents can do

Pick one of three levels:

Granular sorts every action an app offers into read, write or delete, using the app's own description of each action. An action that is only described as reading is a read; one described as removing something is a delete; everything else counts as a write.

Choosing a level switches every single action back on, so pick the level first, then switch off single actions.

Ask me before it sends or deletes

With Ask me before it sends or deletes on (it says "You approve each one in the chat"), Granular stops before any action that writes or deletes, such as sending an email, creating an event or deleting a file, and asks you in the chat. Reading never asks.

The request appears in the chat as a card:

• at the top: Permission · app action
• the action and the account it would use, for example Wants to: Send email (Gmail · Work)
• two buttons: Allow and Decline

Nothing is sent until you click Allow. If the agent asks for several actions at once, they're listed together and you answer once.

There is no "always allow" for app actions. If you don't want to be asked for an app, turn the switch off in its settings.

If you click Decline, the agent is told you declined, not to retry, and to ask you what you'd prefer. If the chat ends or stops while the card is waiting, Granular treats it as Decline.

Switch off single actions

Under Actions at the bottom of the app's settings, every action the app offers is listed in three groups: Read, Write and Delete, each with how many it has. Each group shows five actions; click Show all to see the rest. Hover over an action to read what it does.

• Turn off an action's switch to stop agents using it, whatever the level.
• Groups your level doesn't allow say off at this level, and their actions show Off instead of a switch.

See what agents did

The Activity section shows how many actions ran this month (actions this month), when the app was last used, and the latest actions by name and time. Granular records only the action's name and time, never what was sent. With nothing yet, it says Nothing yet this month.

Defaults

Which connectors have these permissions

Only apps connected from Discover apps. Granular's built-in connectors, your custom connectors and the connectors found on this computer don't have these settings. The Bridge, which lets other models use your Claude account's connectors, has its own setting: read only unless you allow actions. See Bridge.

When the same app is connected more than one way

You might reach the same app two ways, for example Gmail connected here and Gmail from your Claude account. If the connected app is set to Read only, or has Ask me before it sends or deletes on, Granular keeps the other copies of that app out of your chats, because they can't follow those rules. The strictest setting wins. Since asking first is on by default, this usually applies as soon as you connect an app here.

To use the other copy instead, turn Ask me before it sends or deletes off and choose a level other than Read only for the connected app, or switch the connected app off.

What the agent is told when something is blocked

The agent gets a plain message and is told not to retry. For example:

• "Gmail is set to read only in Granular, so "Send email" was not run. The user can change this in Granular: Settings → Connectors → Gmail → What agents can do."
• "Deleting is switched off for Gmail in Granular, so "Delete message" was not run. The user can change this in Granular: Settings → Connectors → Gmail → What agents can do."
• ""Send email" is switched off for Gmail in Granular (Settings → Connectors → Gmail), so it was not run."
• "The user declined: Send email (Gmail · Work). Do not retry it; ask what they would prefer."

If Granular can't check what an action does, it doesn't run it, and the agent is told to try again in a moment.

Troubleshooting

If the agent says an app is "set to read only"
Open the app's settings and choose Read & write or Everything.

If the agent says an action "is switched off"
Open the app's settings, find the action under Actions and turn it back on.

If the agent keeps asking permission for things you trust
Turn off Ask me before it sends or deletes for that app. You'll no longer be asked; the level still applies.

If you see "That change could not be saved. Try again."
Your change was undone. Check your internet connection and click it again.

If you see "The list of actions couldn’t be loaded right now. Your choices above still apply."
The level and the ask-first switch still work. Close and reopen the settings later to see the actions.

If an app connected from your Claude account stopped appearing in chats
The same app is connected here with stricter settings. See When the same app is connected more than one way.

Related