Restrict procedure access
By default, every Handbook procedure is available to every AI agent assigned to that Handbook. That’s the right starting point for most teams — write a procedure, every agent in the same Handbook can use it.
Access rules let you mark a procedure or category as Confidential. Confidential rules are enforced for Agent Stack answers, including both text and voice conversations, so sensitive procedures are hidden from all Agent Stacks.
The access rules panel also stores scope entries for specific Agent Stacks or member agents. Those entries are shown in the product, but retrieval does not currently use them to allow or block procedures. Use the Confidential flag for the restriction that Agent Stack answers honor today.
Where access rules live
Access rules can be attached at two levels:
- Per category — a rule on the category applies to every procedure in it.
- Per procedure — a rule on a single procedure applies only to that procedure.
If your tenant has multiple Handbooks, first choose the correct Handbook from the picker. Then configure category or procedure rules inside that Handbook.
Use a category-level rule when the entire group is sensitive. Use a procedure-level rule when only one entry in an otherwise-public category is sensitive.
Both rule levels count for Confidential: a procedure is hidden from Agent Stacks if either the procedure or its category is marked Confidential. If a category has any access rule, a procedure in it shows the category’s rules read-only (Inherited from category) instead of its own editable panel.
1. Open the procedure (or category)
Go to Handbook in the main navigation.
For a per-procedure rule, click into the procedure to open it. For a per-category rule, open the Manage Categories panel and find the category.
2. Click the shield icon
In the procedure editor (or next to the category in the panel), find the shield icon. Its tooltip reads Edit access rules.
Click it. The access rules panel expands.
3. Choose a rule type
The access rules panel has two levers: toggle Confidential, or add scope entries for specific agents.
Toggle Confidential
The Confidential toggle marks the procedure (or category) as sensitive. Confidential procedures are hidden from all Agent Stack answers, including both text and voice. Useful for:
- Internal escalation contacts (“If the case touches a VIP, call the on-call manager — extension 4012.”)
- Policy details you don’t want surfaced casually (“Maximum goodwill credit is 15% of order value.”)
This is the rule that is currently enforced by Agent Stack retrieval.
Restrict scope
The scope picker lets you record which specific agents or Agent Stacks a procedure is intended for. Two scope types are supported:
- Main agent — a whole Agent Stack.
- Agent config — an individual member agent of an Agent Stack.
Multiple scope entries can be added. They are stored and shown in the access rules panel, but they are not currently enforced by retrieval: adding a scope entry does not, by itself, stop another Agent Stack from using the procedure in an answer.
If the procedure needs to be restricted in current Agent Stack answers, mark it Confidential.
4. Save the rule
For a category, click Save in the access rules panel; for a procedure, click Save changes in the procedure editor. The rule applies immediately. Agent Stack answers start honoring the Confidential flag within seconds.
5. Verify the restriction
Test through an actual Agent Stack conversation:
- Open a conversation handled by an Agent Stack assigned to the same Handbook.
- Trigger the procedure’s scenario in text and confirm the Agent Stack answer does not surface the confidential procedure.
- Repeat the scenario in a voice conversation, if that Agent Stack uses voice, and confirm the same behavior.
Then remove the Confidential flag or test with a non-confidential procedure in the same Handbook to confirm the Agent Stack can still use normal Handbook content.
Finally, test with an Agent Stack assigned to a different Handbook. The procedure should not appear there, because Handbook assignment still controls which Handbook content the agent can use.
If you’re unsure which Agent Stack handles a conversation, check the conversation’s metadata or the routing rules that sent it there.
Removing a rule
Open the access rules panel again. Each rule entry has a delete affordance. Removing all rules returns the procedure (or category) to its default open-to-everyone-in-the-Handbook state.
Common gotchas
- Only Confidential is currently enforced for Agent Stack answers. Scope entries for Main agent or Agent config are stored and displayed, but retrieval does not use them to allow or block procedures.
- Test restrictions in an Agent Stack conversation. Sidekick reads the Handbook without the Confidential filter, so Sidekick visibility does not show what an Agent Stack can use. Use a real Agent Stack conversation, and test both text and voice if the agent supports voice.
- Confidential isn’t a security boundary. It’s an AI-behavior signal — Agent Stack answers won’t surface confidential procedures, but Sidekick still reads them. If you need hard access control on the content, don’t paste sensitive secrets into the Handbook. Reference them by location (“see the operator runbook in 1Password”).
- There’s no role tag. Unlike the Knowledge Base, the Handbook doesn’t use a role taxonomy. Scope entries can document which Agent Stacks a procedure is intended for, but they are not currently enforced as role-based separation.