# Controlling what an external AI agent can do

URL: https://mindmax.me/docs/guides/controlling-agent-access/
Last verified: 2026-11-11

> What a connected AI app can see and change in MindMax, where its work is recorded, and how to pause it, withdraw a proposal or roll a change back.

## Controlling what an external AI agent can do

A connected AI app does not get blanket access to your files. You choose one of two levels per app,
you can hide individual paths, and every write stays inside the workspace and is recorded with the
app's name. When something is wrong, you can pause the app, withdraw a proposal you have not
reviewed, or roll a document back to an earlier version. Nothing in the tool set can overwrite a
document wholesale or delete one.

## Before you start[​](https://mindmax.me/#before-you-start)

- An app [connected to MindMax](https://mindmax.me/docs/getting-started/connect-an-ai-agent/).

- Two minutes in **Settings → External AI**, where each app has its own row and **⋯** menu.

## The two levels[​](https://mindmax.me/#the-two-levels)

| Level | The app can | The app cannot |
| --- | --- | --- |
| Read only | Search, read documents and maps, read your comments, highlights and bookmarks, read a canvas | Propose edits, add comments or cards, create files, run a long method that writes |
| Collaborate (default) | All of the above, plus propose edits, comment, create documents and canvases, run methods with its own model | Overwrite an existing document, delete a file, write outside the workspace |

Read-only connections do not see the write-oriented prompts in the host's **/** menu. The two levels
describe **what an app may reach**; the three tool kinds in the
[agent tool reference](https://mindmax.me/docs/reference/agent-tools/) describe **what each tool does**. They are not
the same split.

**Hiding a path.** A file or folder marked **Hidden from AI** in the file tree is skipped by search
and by every tool, on both levels. Use it for private material, drafts you do not want quoted, or a
folder of large binaries that would only slow a run down. The file stays visible to you.

**Where writes may land.** Paths must resolve inside a workspace you have opened recently. An
absolute path outside them is refused for writing; `read_document` alone may read such a file, and
only for reading. See [what the AI can read](https://mindmax.me/docs/getting-started/what-the-ai-can-read/) for the
full boundary.

## What you can see while it works[​](https://mindmax.me/#what-you-can-see-while-it-works)

| Where | What it tells you |
| --- | --- |
| Status bar pill | Which app is using the library right now. Open it for the last calls, a temporary pause, or disconnect |
| Sessions list | One entry per app: what it read, what it proposed, which long method it ran |
| Review card / pending proposals | Every change to an existing document, still waiting for your decision |
| Version history | Which version you, MindMax or a connected app wrote, and what changed between two of them |
| Local audit log | A record of calls kept for 30 days on this machine |

Comments and cards also carry the app's name, so a note in the margin or a branch on a canvas says
who wrote it. [Working with an external AI agent](https://mindmax.me/docs/guides/working-with-an-external-ai-agent/)
has the map of where each kind of result lands.

## Why a host does not just write files itself[​](https://mindmax.me/#why-a-host-does-not-just-write-files-itself)

Some apps will try to use their own file-writing tool on the workspace folder. On Claude-style
hosts, MindMax registers a write guard and an `AGENTS.md` / `.claude/CLAUDE.md` note that points the
app back to MindMax's tools: `create_document` for new files and `suggest_edits` for existing ones.
That is what keeps the review gate, the quote expansion and the attribution intact. If an app
ignores it, ask for "propose the changes as suggestions in MindMax" — see
[common issues](https://mindmax.me/docs/troubleshooting/common-issues/).

## Undoing something[​](https://mindmax.me/#undoing-something)

| Situation | What to do |
| --- | --- |
| A proposal you have not reviewed | withdraw_proposal, or Withdraw on the review card — the file was never touched |
| A proposal with some good groups | Accept the groups you agree with, reject the rest; nothing is written until you accept |
| An accepted change you regret | Compare in version history and roll back to the earlier save |
| An app doing too much at once | Pause it from the status bar, or switch it to Read only |
| You are done with that app | Disconnect removes only its mindmax-desktop entry; other MCP servers are left alone |

Rejecting an edit leaves the comment thread it answered exactly where it was — you can reply and ask
for another pass. [Revising documents with an agent](https://mindmax.me/docs/guides/revising-documents-with-an-agent/)
covers the review card, and
[working in the margin with an AI agent](https://mindmax.me/docs/guides/comments-with-an-agent/) covers the thread.

## The privacy boundary, with its costs[​](https://mindmax.me/#the-privacy-boundary-with-its-costs)

- The server binds to `127.0.0.1` only, with a separate token per app. **Nothing is uploaded to
MindMax or to us**, and there is no remote endpoint: a server or a phone cannot reach this
library. MindMax must be running; the first tool call starts it in the background if it is not.

- No MindMax model runs on this path and no credits are spent. What the app sends to its own model
provider is governed by that provider's terms, as with anything else you do in that app.

- The flip side of local-only: there is no mobile or web version of this connection, and pausing or
disconnecting an app stops its work immediately — a long method keeps its saved steps but will not
advance until you resume it.

For the reasoning behind the missing delete tool and the review gate, see [MindMax MCP](https://mindmax.me/mcp/) and
[edits wait for you](https://mindmax.me/concepts/edits-wait-for-you/).

## Common problems[​](https://mindmax.me/#common-problems)

**The app cannot write anything.** It is on **Read only**. Switch it to **Collaborate** in the
**⋯** menu next to its row.

**A file is invisible to the app.** Check whether it, or a folder above it, is marked **Hidden from
AI**.

**An absolute path was refused.** Open that folder as a workspace; writes must stay inside one.

**A change appeared without a review card.** It should not. Check the version history for a new file
(a new document is created directly) versus an edit to an existing one (always a proposal), and
report a host that bypassed the guard via [common issues](https://mindmax.me/docs/troubleshooting/common-issues/).

## Next[​](https://mindmax.me/#next)

- [MindMax MCP](https://mindmax.me/mcp/) — the local connection and its design constraints.

- [Working with an external AI agent](https://mindmax.me/docs/guides/working-with-an-external-ai-agent/) — back to the
capability map.

Last updated on **Nov 11, 2026**