Model, limits, and guardrails

Two panels in the Agent's Setup choose the model, bound its work, shape its output, and decide which writes need a human. Both are part of the Setup: they publish with it, and the published values are what runs.

• Setup → AI holds Model & quality, Response and Limits.
• Setup → Settings holds Memory & knowledge, Approvals & output and the Danger zone.

Old links to the former single Config tab still work - they land on whichever of the two now owns the setting.

Setup → AI

Model & quality

Under Model & quality, choose the model the Agent's turns use. Only models your organization currently offers are listed - a provider that is off, or an individual model that has been turned off under Settings → AI settings → AI providers, does not appear. See AI providers for configuring keys.

If people will attach images in this Agent's sessions, pick a vision-capable model: on a model without image support, attached images are omitted from the turn and the conversation says so, naming the model - see Image input.

Response

Under Response, Response mode decides how much of the Agent is in play:

• Standard - full context: integrations, tools, memory, and knowledge are available.
• Quick reply - the Agent answers instantly from its instructions alone, with no integrations, tools, memory, or knowledge. Use it for pure-text assistants where a tool call would never be wanted.

Limits

Runs bounds what one conversation may do:

• Max turns bounds how many model rounds one conversation turn may take before it stops - 20 by default, and never more than 150. Raise it for Agents that chain many tool calls; lower it to cap what a single turn can spend.
• Max concurrent runs caps how many of this Agent's executions may be live at once. Work beyond the cap is refused, not queued silently - the refusal is visible to the caller. The published value governs; raising it in a draft takes effect when you publish.

Delegation → Questions per call bounds how many times an agent or flow this Agent calls may stop and ask it a question (default 3, up to 10; 0 means it takes no questions). Asking is how it avoids guessing when a task is genuinely ambiguous, but every exchange costs both sides a turn, so the budget stops two models talking to each other indefinitely. When the budget runs out the Agent is told so plainly rather than being cut off silently.

Media generation

When the organization allows media generation and the Procedure references the media tools, Limits gains a Media generation row. Quality tier - draft, standard or premium - is the tier every generation from this Agent is charged at; the model never chooses it, because a tier the model could pick is a spend dial the model could turn. Drop a tier rather than fail lets a generation step down one tier when the balance cannot cover the configured one, with draft as the floor; the Agent is told which tier it fell back to so it can say so. Monthly media budget (USD) caps this Agent's successful, charged generations per calendar month. Video and audio are charged on the duration requested. See Cost & budgets.

Setup → Settings

Memory & knowledge

Fall back to general knowledge lets the Agent answer from the model's own knowledge when its knowledge base and tools do not cover a question; the reply says when it does.

The Memory switch decides whether sessions read and record memory cases. The switch is draft configuration and publishes with the Setup; the accumulated cases themselves live in the Memory drawer, and existing cases are kept while memory is off.

Approvals

Approvals and the output shape share one group, Approvals & output.

Approvals lists every tool the Agent reaches and lets you gate specific ones - for example Send message on Gmail, but not Create draft. A gated tool's calls pause the agent for a human decision before running. The row shows how many tools are currently gated.

Tools are grouped under the integration they come from; a collapsed group still says how many of its tools are gated. Reads and writes are both on offer, each row badged Read or Write. The badge is there because gating a read has one extra cost: that call no longer runs in parallel with its neighbours. To require approval for a tool in every Agent at once, an organization admin uses Tool approvals on the integration's page - tools required that way are shown above this list and gate regardless of what is selected here, and no Agent can remove them. The drawer also sets how long a pause waits for this Agent. How the three layers of approval fit together is in How approvals are layered.

A selected tool in an attended conversation asks its turn initiator for confirmation when it uses that person's own credentials or the domain's credentials. Only that person can answer, including a Viewer, and it stays in the conversation. Unattended work, work using another person's credentials, and organization-required gates instead create approvals in Sessions → Approvals, routed to the authorized deciders.

The two deadlines are set separately, because the people waiting are different. In a chat defaults to 4 hours - the person was asked directly and is sitting there. With approvers defaults to 72 hours, which covers a weekend in a queue somebody visits. Each accepts a minute at the floor and thirty days at the ceiling. If nobody decides in time, the turn fails rather than executing the call without a decision.

Choose gates by blast radius: sending mail, moving money, and deleting records deserve a gate; ordinary searching and reading do not - a gate on every tool teaches approvers to rubber-stamp. A read earns one when the query itself is the risk, such as a search that could sweep up far more than the question needed.

Output shapes the answer: by default the Agent answers in natural language. Set it to JSON and supply an Output schema when a machine consumes the answer - a Flow step, or an API caller that needs fields rather than sentences.

Where the Evals entitlement is on, Eval gate decides whether publishing is refused until this Agent's eval suite has vouched for the exact changes being published. See Evals.

When another agent or flow called this one

An Agent can be run by another agent or flow rather than by a person, and two settings only apply then. Both live with Approvals because both are about what a caller may do on this Agent's behalf.

An agent or flow that calls this agent may approve it too, shown under each gated tool, lets the CALLING agent or flow decide that gate as well as the people who could always decide it. It is an ADDITIONAL decider, never a replacement: the approval still appears in Sessions → Approvals, a person with rights can still act on it, and whoever decides first wins. Leave it off - the default - and gates go to people only, which is the right answer for anything you would want a human to justify.

Open a tool to callers when the calling agent or flow genuinely has the context to judge it and waiting for a person would strand routine work. Do not open one whose blast radius you would not want an agent or flow to accept unattended: the caller is a model, and it decides without anyone watching.

Danger zone

Archive agent is available for draft and active Agents, including Agents with runs, sessions, triggers, or callers. Archiving prevents new starts and keeps the Agent's configuration, sessions, and run history. Existing links are retained, but they cannot start the archived Agent.

Delete agent permanently removes an unpublished Agent without session or run history. Its trigger and automation links are removed automatically; shared triggers are kept. Archive Agents with history.

Tips

If the selected model is unavailable, open Settings → AI settings → AI providers to check the provider's state and key - LLM_NOT_CONFIGURED means no usable key for the selected provider. If runs are refused at capacity, raise Max concurrent runs and publish. See Troubleshooting.