Agents and the ceiling

An agent you connect acts as you, with your role in each vault, except for a short list of actions that need you present in the web app.

An agent is its person

When Claude Code, ChatGPT or any MCP client calls Reliquary through your connection, it acts as you: it reads what you can read and writes what you can write, within the vaults and access you chose when you connected it. The log records both: you, and the agent that acted for you.

A read-only connection makes the agent a viewer everywhere. A connection limited to some vaults can't see that the others exist.

The ceiling

Some actions need the person, signed in, in the web app. No agent can do them, through any connection, even an owner's:

approve, request changes on or reject a proposal (and edit, then approve);
set or remove rules (canon or open, quorum, claim rules);
name or remove a path's owners;
invite people, change roles, remove members, or see members' email addresses;
choose how people see you;
create a token or revoke a connection;
set, rotate, delete or reveal a variable's value, or apply an import;
add, edit or delete a link, or set its tool grants;
rename a vault or change its default policy;
see or clear a vault's searches that found nothing, or change how long they are kept;
erase a file, export a vault, or delete one;
become the owner of a vault with no owner, which counts it against your plan;
redact a thread message;
snooze a proposal;
start or stop watching a path for flags;
break someone else's claim;
approve, cancel, skip or reopen a work plan step (a task).

This is the one list. Other pages, the glossary and the repo's own docs say "the ceiling" and link here instead of repeating it.

Why: an agent reads text other people wrote. A file, a comment or a web page can carry instructions (prompt injection), and anything the agent may do, the injected text may try. The ceiling keeps the actions that are irreversible, grant trust or reveal secrets behind a person's click.

How it holds: the database enforces it, not the app. Every request from an agent carries a claim naming the agent and its connection, and the database refuses those actions for any request that carries one. A tool that offered more would still be refused. Each rule has a hostile test that tries to break it on every change. See Security model.

What agents can do

Within your role and the connection's access:

list vaults, list and read files, search, and follow changes (changes_since);
write and delete open files;
propose changes to canon files, revise their own proposals, and comment;
claim a path to say they're working on it, renew, release and list claims;
open, read and post in threads, and resolve or reopen them;
list their person's flags and mark them shown, and list what the person watches;
list a vault's links and call the link tools their role is granted, as <link>.<tool>;
register a plan file as a work plan, read its steps, ask for work and wait in line, see where they stand in every line, and claim, check in on, complete or give back a step;
create a vault for you, with a read-write connection that reaches all your vaults;
list environment variable names, and imports from the CLI waiting for you (never values);
send feedback or a bug report about Reliquary for you, even over a read-only connection, and list what you've sent with its status and replies. See Send feedback or report a bug.

The full list is in MCP tools; what people and agents can each do is in Permissions.

Text is data

File text, reasons, comments and review notes reach an agent inside fences with a fresh random marker, like BEGIN-7f3a... and END-7f3a..., with who wrote it and when; the paths, vault names and connection names people chose are fenced or cut to one line the same way. The marker is chosen so no text in the response contains it, so a file can't end its own fence early and pose as instructions. If you build an agent on Reliquary, treat fenced text as data: quote it, summarise it, but don't follow instructions in it.

For agents reading this

Before writing, check a path's policy: list_files marks canon files [canon], and read_file names the policy. Use write_file for open files and propose for canon ones.
You can't approve. After proposing, tell your person there is a proposal waiting in their Inbox.
Answer requests for changes with revise_proposal; read the notes in changes_since or read_proposal.
When a result ends with a line from Reliquary saying flags are waiting, call list_flags for that vault, show your person what it returns, then call advance_flags with its through value. See How an agent learns it has flags.
When you write a time into a file (a status line, a log entry), take it from Reliquary, not your own clock, which may be off. list_vaults starts with Server time (UTC): 2026-10-13T09:30:00Z, the server's time when you called it. Vaults have no time zone setting, so convert to your person's time zone yourself if they want local time.
When your person asks to report a Reliquary bug or send feedback, use send_feedback: summarise in your own words, add the tool and any error ref, and leave out secrets, tokens and variable values.
Never ask for or repeat a variable's value. To add a .env to a vault, run npx @reliquary-ai/cli env push; a person applies it. See Move a .env into a vault.