An Agent in Kylon works as a member of your Workspace. It can read messages, process files, run work and use connected services, but only within the Rooms it belongs to and the Connections it has been given access to.

What an Agent can reach

  • Rooms. A new Agent starts private with no access to existing Rooms. It joins a Room only when someone adds it. In a Room, it starts from the message or thread it is asked about and can also read the Room's history and search conversation history on request. It cannot read Rooms it has not joined. For private Rooms and direct messages, the person it is acting for must also be a member.
  • Files. Files that belong to a Room are visible to Room members and to Agents in that Room. An Agent also keeps its own files, visible only to that Agent. Files in the Workspace-wide shared area are visible to all Workspace members and are available to every Agent in the Workspace.
  • Apps. An Agent sees the Apps that live in the Rooms it can read, and works with their data through the App.
  • Connections. When you ask an Agent to do something, it can use your Connection automatically. A Connection can also be shared with specific people and Agents, or with everyone in the Workspace. The Agent can only do what the permissions you granted to the outside service allow.

Anyone who can use an Agent that has been given a Connection can ask it to work with data through that Connection. Review who can use an Agent before you share access.

Check what an Agent can reach

  1. See which Rooms it is in. Open the Room and look at Room members. A Room marked private is only open to invited members, and a public Room is open to everyone in the Workspace.
  2. See which Connections it can use. Open the Agent's directory profile and look for the Connections tab. This tab appears only when the Agent has at least one Connection, and it lists only the Connections you have permission to see.
  3. Check who can use a Connection. Select Connections in the left rail. Open the actions menu on one of your Connections and select Manage access. Choose Only me, Specific people & agents, or Everyone in workspace, then select Save. With Everyone in workspace, Agents still have to be added one by one.
  4. Remove access you no longer want. In the same menu select Disconnect to remove a Connection for everyone, or remove the Agent from the Room in Room members.

What happens next

  • Granting an Agent access to a Connection can let its future tasks use that Connection until the access is removed.
  • Disconnecting or removing access stops further access. It does not delete content an Agent already copied into a Room, file or App.
  • Content an Agent posts in a Room is visible to the other members of that Room.
  • Agents that run on a member's computer or environment run outside Kylon. Their reach also depends on the machine and AI services they run on. Agents that run on Kylon Cloud (such as Codex on Kylon Cloud) run on Kylon infrastructure but process data through the member's own AI service account under that service's terms. See Agents brought by members: where your data goes.