Tool Policies

Every integration gives the agent a set of tools. Tool policies decide two things for each tool: who can see and use it (the minimum role) and how a run is confirmed (the approval setting). Admins manage both from the Toolsets tables, or by asking the agent in Explore.

Where to Find It

1. Go to Settings > AI Settings.
2. Scroll to Toolsets. The Toolsets by Integration table lists every connected integration with its tool counts.
3. Click an integration to open its tools table.

Only users with the Admin or Owner role can change policies. Other roles can view them.

The Tools Table

Each row shows the tool's name, a Read, Write, or Execute tag, a short description, its Risk, Minimum role, Approval, and an On switch. Click a row for details, including whether the tool runs on a shared connection or a Personal connection that acts as its owner's account, and the tool's input schema.

Use the Search tools box, the Category and Risk chips, and the changed from default toggle to narrow the list. The View as dropdown shows the table as a given role sees it -- Customer, Technician, Operator, Manager, Admin, or the agent itself -- and reports how many tools are hidden from that role.

Select several rows to use the bulk bar: Set minimum role, Set approval, Enable, or Disable.

Minimum Role

The minimum role controls visibility. Roles below it never see the tool and cannot request it.

Minimum role	Who sees the tool
Customer	Portal users of the company, plus all staff. Only available for tools that work in the customer portal.
Technician	Everyone on staff
Operator	Operators and above
Manager	Managers and above
Admin	Admins and Owners

Each tool ships with a built-in default, but the default is not a floor. Admins can set the minimum role lower or higher.

Approval

The approval setting controls how a run is confirmed, from least to most strict.

Approval	What happens
Automatic	Runs without asking.
Per session	The person confirms the first run in a conversation. The grant lasts for about an hour.
Always	The person confirms every run with an in-chat card.
Escalate	Someone above the minimum role approves every run.

With Escalate, the approver is the next role above the tool's minimum role, capped at Admin: a Technician-level tool escalates to Operators and above, an Operator-level tool to Managers and above, and a Manager-level tool to Admins. A requester who already meets that level can approve their own escalation, except at Admin level, where a different Admin or Owner must decide.

Locked Settings

Some tools cannot be set to every option:

• Tools that must always be confirmed by a person cannot be set to Automatic or Per session.
• Tools on a personal connection (a user's own mailbox, for example) cannot be set to Escalate. Only the owner confirms them.
• Critical tools cannot be switched off.

A control that differs from its default shows Default is X with a Reset link.

Defaults

Out of the box, every write and execute tool is set to Technician and Always, so the technician who asked for an action confirms it with a card before it runs. Reads mostly run Automatically. A few tools carry stricter defaults, including finance and invoice reads, BitLocker recovery keys, bulk ticket operations, and subscription quantity changes. Billing-related writes also require the user's Billing Admin flag.

How Approvals Reach People

In Explore and Ticket Chat

A pending run appears as a card with Approve and Deny buttons and the time it expires. For escalations, the card states who it is waiting on, for example "Escalated, awaiting Manager or above", and tells an eligible viewer that they can approve it themselves. After a run, the Used N tools card lets anyone reading the conversation view the parameters of plain read tools. Password and token values are never shown.

The Escalations Page

Escalations in the sidebar shows two lists:

• Waiting on you -- your own pending confirmations.
• Explore chat approvals -- escalations your role can resolve, each with Approve, Deny, and a Review link.

The sidebar badge counts both.

Email

When a run escalates, Junto emails members flagged as Escalation approver whose role meets the required level. If no one is flagged, every active member whose role can approve is emailed. The flag is set per user under Settings > User Management. In Explore chat, who can approve is decided by role; the flag controls who is notified first.

Slack and Teams

Explore chat approvals are not sent to Slack or Teams. Runbook steps that need approval during ticket chat are posted there -- see Reviews & Approvals.

Asking the Agent

In Explore, any staff member can ask about policies: "which tools need approval", "who can run the Pax8 quantity change", or "what have we changed from default". The agent reports the current and built-in settings, who approves an escalation, and any locks.

Admins and Owners can also ask the agent to change the minimum role or approval for up to 50 tools at once, or reset tools to default. The agent shows a confirmation card listing each tool's setting before and after. It refuses the whole change if any value is locked, a tool is unknown, or a policy changed while the request was pending. The agent cannot switch tools on or off, and cannot change its own policy. Changes apply immediately, appear in Settings, and are recorded in the audit log.

Troubleshooting

• A technician cannot see a tool -- Its minimum role is above Technician. Use View as > Technician to confirm, then lower the minimum role if appropriate.
• "Waiting for a team member with approval permission" -- The tool is set to Escalate and no one at the required level has decided yet. Check Escalations > Explore chat approvals.
• An Admin cannot approve their own request -- Admin-level escalations need a different Admin or Owner.
• Automatic is greyed out -- The tool is always confirmed by a person and cannot be relaxed.
• Nobody received an escalation email -- Flag at least one member with the right role as Escalation approver under Settings > User Management.