Security

Manual — AI agents · chapter 6 of 7

The server was designed so that connecting an agent does not widen what could already be done in H2O.

• Off by default, per company. Turning it on is an administrator decision.
• Explicit opt-in per key: without the mcp scope, no key talks to agents.
• Same rules as the system: every query goes through the profile rights and the site reach of the user, like any access.
• Restricted writing: only opening a ticket and commenting, and only with writing allowed. Nothing is changed, deleted or closed by an agent.
• Access with an expiry for app authorizations, cancellable at any time.
• Logging: every agent call is logged with the company, the key, the tool and the time.

Warning

Ticket and follow-up texts may have been written by third parties — a requester, an equipment e-mail. The server marks those fields as third-party content, but protection against instructions hidden in those texts also depends on the assistant you use. For agents with writing allowed, prefer assistants that ask for confirmation before acting.

Usage limit

Each key has a requests-per-hour limit, set by whoever creates it. The agent server accepts bursts — several queries in a row — within that limit. On reaching it, the agent is told to try again shortly. The limit applies only to agent keys and authorizations; it does not affect the web or the mobile app.