Add a Capability to a Specialist

Without capabilities, an Agent Stack can only talk. With them, it can act — call your order API, process a cancellation, look up a customer record, fire a webhook. Capabilities are attached per specialist, so the order tracker can call the order-lookup API while the billing agent can only read invoices.

Before you start

• The capability must already exist in Settings → Capabilities. If not, create one first.
• Decide the security level — what authentication state must the customer be in for this capability to fire?
• L0 — always available, even to anonymous callers (e.g. order-status lookup with the order ID).
• L1 — after the customer claims an identity (e.g. they typed their email).
• L2 — after OTP verification.
• L3 — after full authentication.

Pick the lowest level that’s safe. L0 is fine for read-only public data; L3 is required for anything that changes account state.

Steps

1. Open Settings → Agent Stacks → [stack] → Orchestrator.
2. Click the specialist node that should get the new capability.
3. Click the Capabilities sub-tab.
4. Click + Add capability.
5. Pick the capability from the list. (You’ll only see capabilities your tenant has defined.)
6. Set the security level for this assignment:
   Leave it as Inherit to use the capability’s default security level (set when the capability itself was created).
   Override to a specific L0/L1/L2/L3 to use a different level for this specialist.
7. Set the approval mode:
   Auto — the AI calls the capability without human review.
   Human — the AI prepares the call but a human approves before it fires.
8. Save.

Verify it worked

• The Capabilities sub-tab now shows the new capability in the list with the configured security level and approval mode.
• The specialist’s slide-out summary card (top of the panel) shows a non-zero Capabilities count.
• Open the Testing tab and ask the specialist a question that should trigger the capability. The reply should include the action result (e.g. order status, refund confirmation).

When to override the default security level

Capabilities have a default security level set at the capability itself. Override on a per-specialist basis when:

• A specialist serves higher-risk customers and you want to require stronger auth (e.g. an enterprise specialist requires L3 for actions that another stack runs at L1).
• A specialist serves lower-risk customers and you want to relax auth (e.g. internal-only stack runs everything at L0).

When in doubt, leave it as Inherit — the capability’s default is usually correct.

Troubleshooting

• Symptom: A “warning” icon appears next to a capability in the list. Fix: that’s the L0-on-action warning — actions (capabilities that change state, not read state) shouldn’t generally run at L0. Bump the security level to L1+ unless you have a deliberate reason.
• Symptom: The capability never fires in test. Fix: confirm the test session’s auth level meets the capability’s effective level. Open the test panel, click Verify identity, and bring the auth level up.
• Symptom: The capability fires but the AI doesn’t reference its result. Fix: check the specialist’s Instructions — sometimes a poorly worded instruction tells the AI to ignore certain capability outputs. Also check the capability’s response format in Settings → Capabilities; if the AI can’t parse the response, it won’t use it.
• Symptom: Approval mode is Human but no approval ever comes through. Fix: approvals appear in the conversation as a pending action. The handler must approve from the conversation detail panel; configure who can approve via Roles & Permissions.

See also

• What is a specialist agent?
• What are Capabilities?
• Add a specialist agent