Tool permissions

Decide, tool by tool, whether Henry runs it automatically or asks first.

Every tool a connection provides has a permission. Open the connected account and go to the Tools tab.

The settings

Setting	What it means
Run automatically	Henry uses the tool whenever it is the right thing to do. No card.
Ask for confirmation	Henry stages a confirmation card and waits for your Confirm.
Off	Henry cannot see or use the tool.

Tools are labeled Read or Write. Reads default to running automatically. Writes default to asking for confirmation. Anything that spends money always asks, regardless of this setting.

Changing permissions from a card

You do not need to visit the Tools tab. Every confirmation card offers an “always allow” choice:

• Confirm + always allow this tool sets that one tool to Run automatically.
• Confirm + always allow this integration sets every tool on that connection to Run automatically.

In the web app the buttons are Always allow and Approve all & always allow.

Whose setting is it?

Tool permissions belong to the connection, so they apply to everyone who can use that connection. On a team connection, an admin’s choice affects the whole team. Per-person control is done with access levels on the Access tab: give someone Read-only and Henry uses only the read tools for them, whatever the write tools are set to.

Tasks are approved separately

Scheduled tasks do not use these settings at run time. When you activate a task, you approve the specific write tools it will use, once. See Activating and running tasks.

Workspace policy

Admins control who may connect and edit integrations in Settings → Permissions → Teammate integration permissions:

• Connect new integrations. When off, only admins can connect integrations.
• Edit other people’s integrations. When off, teammates can only edit integrations they set up.