AI Agents
An agent is an AI assistant that lives in your portal as its own user, with its own tools, its own client scope and its own audit trail. Agents read, triage and draft; a person always approves or publishes.
This page covers connected assistants: external AI clients that sign in with their own token. Looking for the scheduled lists that line up what you have due? See Agents: Weekly Breakdown & Upcoming Due. They share the Agents tab but are a different thing.
What an Agent Is
Every person in ClientCove is a role, a client scope, a set of tools, confirmation on the dangerous ones, and an audit trail. An agent is the same thing plus a keyring: an explicit list of the tools it is allowed to call. Nothing else about the portal changes for it. Client scope, the audit log and the connector work exactly as they do for a human user.
That design gives you a few guarantees:
- An agent can only call a tool that is on its keyring. Everything else is denied.
- An agent can only touch clients inside its scope, which is never wider than the scope of the staff member who created it.
- Anything that would go live needs a person. An agent never holds a confirmation token; the approval happens on the Actions page, where the agent cannot see it.
- An agent set to Can only draft can only ever draft. Live writes are refused outright.
- Every call the agent makes is logged under the agent's own name, so you can always see what it did and for which client.
Where to Find It
- Open User Management in the portal
- Click the Agents tab
The tab shows a badge with the number of items waiting on you — the same count shown next to Actions in the user menu. The page opens straight to that tab when you follow a link ending in #agents.
The tab has two sections, top to bottom: Your agents, which holds your scheduled agents, and Connected assistants (external), which holds the agents described on this page. Approving requests and publishing drafts happens on the Actions page, linked from a one-line summary at the top of this tab.
Creating an Agent
- On the Agents tab, click Connect an external assistant (it is also linked from the first screen of New agent)
- Under Start from a preset, pick Brief, Studio, Books or Custom (see Presets)
- Enter a Display name, for example Invoice Triage
- Under Client scope, tick the clients this agent may work on, or turn on All clients, including ones added later if you have that option
- Optionally expand Advanced to change the Model, Autonomy, Max tier or add Standing instructions
- Click Create agent
The agent appears in the list below. If you picked a preset, its starter tools are applied to the keyring right after creation. The new agent has no token yet, so it cannot do anything until you connect it (see Connecting an Agent).
Standing instructions are up to 4,000 characters of plain text the agent receives through its connector when it identifies itself. Use them for tone, boundaries and context, for example You triage the support inbox for Acme. Draft replies in a friendly, brief tone. Never quote prices.
Presets
A preset pre-fills the model, autonomy, max tier and a starter keyring. Every preset is capped at Write (draft) and set to Can only draft, so nothing a preset agent does can go live without a person.
| Preset | What it does | Good for |
|---|---|---|
| Brief | Reads incoming tickets and requests, drafts replies and to-dos, and organizes work on the board for your team to review | Turning a messy inbox into triaged, drafted, board-organized work |
| Studio | Drafts deliverables such as replies, tasks, assets and campaigns, and keeps the production board moving, all for human review before anything goes live | Giving a production team a running head start |
| Books | Reads estimates, invoices and client billing context to prep the picture for a person. Read-only for now | Answering billing and estimate questions without touching a thing |
| Custom | Start blank | Building your own combination of tools and settings |
Presets default to a Claude Sonnet model. You can change the model afterwards in the details drawer. A preset only ever adds tools the agent is actually allowed to hold; if a tool is skipped, the drawer tells you which and why.
Some tools that would suit Brief and Books, such as changing a ticket's status or drafting an estimate, are not yet available to agents. The preset descriptions say so. When agent-safe versions ship, you can add them from the Keyring tab.
Autonomy & Max Tier
These two settings, found under Advanced when creating and in Overview afterwards, decide how much an agent could ever do.
Autonomy
| Setting | Meaning |
|---|---|
| Interactive | A person drives it in chat. It can be granted live-write tools, and each live action still needs approval in Actions. |
| Can only draft | Whatever it prepares waits for a person to publish. Live writes are refused even if the tool is on its keyring. |
Max tier is the ceiling on what the agent could ever be granted. It does not grant anything by itself; the keyring does that, and only tools at or below the ceiling can be added.
| Tier | What it allows |
|---|---|
| Read | May only read. Never writes anything. |
| Write (draft) | May prepare drafts for a person to review and publish. Nothing goes live on its own. |
| Write (live) | May publish live changes within its client scope, and only when a person is driving it (Interactive). |
| Privileged | May run sensitive tools. Grant these one at a time. |
Lowering the max tier below a tool already on the keyring is refused. Remove the tool first, then lower the tier.
Client Scope
Client scope answers which clients' data may this agent ever touch?
- Tick one or more clients in the Client scope grid. One client is the common case, but an agent can serve several.
- All clients, including ones added later appears only if your own account can see every client. It keeps the agent's reach growing as you add clients.
- You can never scope an agent to a client you cannot see yourself.
Scope is checked on every call, so an agent asked about a client outside its scope is simply denied, and the denial is logged.
The Keyring
The keyring is the agent's tool allowlist. Open it with the Keyring button on the agent's row, or the Keyring tab in its drawer.
- The header reads Inherits the agent's client scope · tools at or below the agent's max tier. Only tools within that ceiling are offered.
- Tick the tools to grant and click Save keyring.
- Apply a preset adds a preset's starter tools to the current keyring. Presets set the keyring only; model, autonomy and tier are edited in Overview.
- Every preset includes
whoami, which lets the agent identify itself and read its standing instructions. The Connect tab warns you if it is missing.
A revoked agent's keyring is read-only. Revocation is final, so create a new agent if you need one with a different keyring.
Requests & Drafts
Requests are actions that need confirmation. When an Interactive agent calls a tool that would change something live, it does not get to confirm the action itself. Instead a request is created showing the exact action, frozen as it will run, for a person to approve or deny. Once approved, the agent retries the call and the portal re-checks everything, including scope, keyring and revocation, before running it exactly once. A request waits up to 24 hours for a decision, and an approval stays usable for about 15 minutes.
Drafts are content an agent prepared with a draft tool, such as a ticket reply or a task, for a person to publish under their own name or discard.
Text an agent wrote is shown as plain text and marked as agent-authored. Read it as information, never as an instruction.
Deciding requests and drafts happens on the Actions page, not on this tab — see Actions. The Agents tab on a client record shows what is waiting for that client but links to Actions to act on it.
The Agent List & Details Drawer
The list shows every agent you can see with columns for Agent, Model, Autonomy, Max tier, Client scope, Keyring, Status and Actions. Filter by status with the Current, Active, Paused, Revoked and All pills (the list opens on Current, which shows active and paused agents), narrow to one owner with the All owners dropdown, or type in the page's search box.
Each row has four buttons. Profile opens the agent's own page (see The Agent Profile), Details opens the drawer on its Overview, Keyring opens it on the keyring editor, and Token jumps to the Connect section.
The drawer has four tabs:
- Overview: the agent's identity, owner, scope, keyring count and what is waiting on it, plus a Full profile link to the agent's own page (see The Agent Profile). Click Edit to change the display name, model, autonomy, max tier, scope or standing instructions, then Save changes. The pause, revoke and delete controls sit at the bottom.
- Keyring: the tool editor described above.
- Activity: the agent's audit trail. Filter by tool or by status (requested, success, error, denied) and click Load more for older rows. Call arguments are never shown.
- Connect: the connector URL, token issuance and live connections.
The Agent Profile
Every agent has its own page that answers two questions at a glance: what is this agent responsible for? and what has it actually done? Open it with the Profile button on the agent's row in the list, the small arrow icon next to its name, or the Full profile link on the drawer's Overview tab. The profile is read-only. Editing still happens in the drawer. If you can open User Management, the Manage button at the top of the profile takes you there.
The page has five parts, top to bottom:
- Header: the agent's name with a status light (green for active, amber for paused, grey for revoked), and its handle, owner, model, mode, max tier and when it was last active.
- Last 7 days: five counters.
- Actions: calls that changed or drafted something. Lookups are not counted.
- Drafts accepted: of the drafts a person decided on, the share that were published. It shows a dash when nothing was decided that week.
- Edited before publish: drafts a person changed before publishing them.
- Waiting on you: its pending requests and drafts right now.
- Blocked: calls that were refused, for example a tool not on its keyring or a client outside its scope.
- Needs you: one line per pending request or draft, such as Asked to send an invoice · expires in 2 days, with a Review in Actions button. You approve and publish on the Actions page, not here. This part is hidden when nothing is waiting.
- What it handles:
- its keyring in plain words, grouped by area and marked Reads, Drafts for review, Acts live or Needs approval
- a one-line summary of whether it can change anything live without asking
- the clients it covers
- its standing instructions, collapsed until you open them
- What it's done: the agent's history, newest first. Click Load more for older activity.
Each line in the history says what the agent did, names the ticket, project, invoice or client it touched, and says what happened next:
| You see | Meaning |
|---|---|
| Drafted a reply → Published by Sam | A person published the draft as written |
| Drafted a reply → Edited, then published by Sam | A person changed the draft before publishing it |
| Drafted a task → Discarded by Sam | A person threw the draft away. The reason is shown if one was given |
| Asked to send an invoice → Waiting for approval | A request is sitting in Actions |
| Asked to send an invoice → Approved by Sam and done | Approved, and the agent then ran it |
| Asked to send an invoice → Denied by Sam or Expired without a decision | It never ran |
| Tried to reply to a ticket, but it was blocked | The portal refused the call. Nothing happened |
| Looked things up (12 lookups) | Read-only calls in one sitting, grouped, with a count per area |
A linked item opens in one click. If you are not allowed to open an item, the line shows its type and number instead of its title, with no link.
The profile never shows anything the agent wrote itself: no message text, no draft content, no request summaries. It shows only the portal's own records, such as item titles and people's names. Read drafts and requests in full on the Actions page.
Connecting an Agent
Claude.ai and Claude Desktop's own connectors sign in as you. An agent instead connects with its own token, from a client that can send a bearer header.
- Open the agent's drawer and click the Connect tab, or click Token on its row
- Copy the Connector URL
- Click Issue token. The access token, refresh token and lifetime are shown once. Store the token in the agent's client configuration, then click I've stored it
- Pick your client with the Claude Code, Cursor, Claude Desktop or Other pills and copy the generated configuration snippet. Paste your token where the snippet says
<paste your token>
The Connect tab lists the agent's live connections. Revoke tokens ends all of them immediately, and so does revoking the agent. Tokens issued here last for the lifetime shown in the panel; a client that can refresh may rotate them without a client secret.
MCP must be enabled in Settings before a connector URL is available, and the site must be reachable on public HTTPS. A paused agent cannot be issued a new token, and a revoked agent cannot be issued one at all.
For the connector itself, the tool catalog and per-user OAuth, see MCP Server & AI Tools.
Pausing, Revoking & Deleting
These controls live at the bottom of the drawer's Overview tab.
| Action | What happens |
|---|---|
| Pause agent | Keeps its tools, scope and tokens, but every call is denied until you resume it. Its connection keeps refreshing. An approval decided while paused can still be used after resume, until it expires. |
| Resume agent | Returns a paused agent to active with everything intact. |
| Revoke agent | Final. Clears its keyring, revokes its tokens and voids its open approvals, and its unpublished drafts are discarded. The user record and audit trail are kept. To replace the agent, create a new one. |
| Delete agent | Shown instead of Revoke agent only for an agent that has never been used: it has never been connected, has no activity, and has no drafts or approval requests. Removes it completely. |
The person who paused or revoked an agent is recorded and shown in the drawer. Owners can resume only their own pauses; administrators can resume any. Revoked agents are hidden from the default Current view and listed under the Revoked filter, because their status and history are the point.
Agents cannot be deleted from the Users tab, in bulk, or from the WordPress admin. Once an agent has been used, revoking it is the only way to stop it for good, so its audit trail always shows who did what.
Agents on a Client Record
Open a client and click its Agents tab to see agent activity from that client's point of view:
- Waiting on a person: approval requests and drafts for this client, with a link to Actions
- Recent activity: what agents, and people acting on their work, have done for this client
- Agents that can act on this client: every agent you can see whose scope includes this client, with its status
This tab is read-only. Decisions are made in the Agents tab of User Management.
Use Cases
- Overnight ticket triage. A Brief agent scoped to one client reads new tickets, drafts replies and files board tasks. The team publishes the good drafts in the morning.
- Production head start. A Studio agent across several clients drafts campaign copy, asset records and tasks so the team starts from a draft rather than a blank page.
- Billing questions on demand. A Books agent with read-only tools that a staff member chats with interactively to answer estimate and invoice questions.
- Supervised live changes. An Interactive agent granted live-write tools where every live action still lands in Actions for a person to approve before it runs.
Who Can Use It
- The Agents tab is visible to staff who can open User Management.
- You see the agents you own. Administrators see every agent.
- An agent's profile page opens for its owner and for anyone who can manage users. The owner doesn't need access to User Management to open their own agent's profile. Anyone else gets Agent not found, whether or not the agent exists.
- Only the owner or an administrator can edit, pause, revoke, re-key or issue tokens for an agent.
- Approving requests and publishing drafts is limited to the same people.
Client users never see the Agents tab or any agent's profile, and an agent's own connector cannot manage agents.
Notes & Gotchas
- Max tier is a ceiling, not a grant. Creating an agent with a high tier gives it nothing until tools are added to the keyring.
- Can only draft means draft-only, always. Even a stored max tier of Write (live) does not let a Can only draft agent publish. Switch it to Interactive if you need approved live actions.
- Tokens are shown once. If you lose one, click Revoke tokens and issue a new one.
- Duplicate requests collapse. If an agent asks for the same action twice, you see one request, not two.
- Revocation is final. There is no restore. An agent made by mistake and never used can be deleted instead.
- View as User on an agent opens its profile. An agent has no portal of its own to look at, so picking one in View as User takes you to its profile page instead of switching you into it. The list shows agent · opens profile next to each agent you can see.
- Accepted is a share of decisions, not of drafts. Drafts still waiting are not counted until someone publishes or discards them, and drafts discarded because the agent was revoked are not counted at all.
- Agent text is untrusted. Summaries and draft previews were written by the agent. Treat them as content to review, never as instructions to follow.