Stay in control

"Draft a reply to that enquiry, but do not send it until I have seen it."

Player One writes the draft, stops, and asks you. The question arrives in the chat you started, in the notification bell, and on whichever channels you told it to use, so an answer can come back from your phone on Telegram. Reply anywhere and the work carries on.

Player One does the part you asked for and comes back for the part only you can decide.

It asks before the things that matter

"Clear out the old supplier files, but show me the plan first."

That becomes a job, and its coordinator writes a plan before anything happens. Phases you would not want done by surprise are held until you approve or reject them, from the Review Plan button on the task's card. Rejecting asks for a reason, which goes back to the coordinator. Jobs waiting on you are gathered under Needs input on the Jobs page (/jobs/view/needs-input), and the question also shows in the chat that started it.

Written processes pause the same way. In a flow you write a line such as "Ask the operator: approve the proposed handling for this message?" and the process stops there until you answer. Flows are early access: they work, but they are not fully proven yet.

You choose what each agent may run

Your installation is a computer, and your agents work on it: installing a tool, converting a file, running a script. Each agent has a permission mode that decides what it may run there without asking you first:

• Conservative. Asks before every program it has not been allowed.
• Most things. Everyday tools run; anything new asks once. The everyday tools are the ordinary file and text tools, archives, downloads, Git, Python, Node and their package managers, and the usual document and media converters. Deleting files, logging in to other machines, containers and administrator rights are left off on purpose, so they ask.
• Everything. Runs anything without asking.

Whatever the mode, a command that deletes a folder and everything in it asks you first, and that question never offers Always.

A new installation starts on Most things. An installation that was already running when modes arrived was set to match what it did before, so nothing started asking overnight: if its agents already ran commands without asking, it is on Everything.

Set the mode on the agent's own page: Manage > Agents (/agents), open the agent, then Advanced > Permissions (/agents/<name>/advanced/permissions). An agent uses the Site default unless you switch on Own setting, and changing the site default there changes it for every agent without a setting of its own. The same tab lists the programs that agent is Allowed for good, where you can remove one, switch it to Blocked so it never runs, or add a program by name. Once an agent has individual changes, its mode reads, for example, "Custom (from Most things)".

Commands that ask

When a command needs your answer, a small card appears in the chat that raised it, such as "Can Nova use Python?", with the command underneath and three buttons.

• Once runs it this time only.
• Always lets that agent use that program from now on, with any arguments. It is added to the agent's Allowed for good list, so you are not asked the same question again.
• No means not this time. To stop a program for good, block it on the Permissions tab, which the card's Change what Nova can run link opens.

The card waits quietly in its chat and can be answered for 30 minutes. If it is still waiting after two minutes, the notification bell picks it up as well. When you started the work from Telegram, Discord or Slack, the question comes to you in that chat with the same three buttons, and only your own presses count. On an app without buttons, a short line tells you the question is waiting in Player One.

A card only makes sense where somebody is there to answer it. Work running by itself, a scheduled task at four in the morning, a job working through its queue, a helper or a phone call, is not held on a card nobody will see: a command that would ask is not run, and the agent is told that nobody could be asked and that you can allow the program on its Permissions tab. Allow it there, or answer Always the next time you see the card, and the next run goes through. You find a failed run in the morning rather than a run that quietly hung until it expired.

Commands on your own computer through Sidekick follow the access you chose for that computer instead, and a sandboxed agent stays inside its sandbox whatever the mode.

Elevation is the stronger version of the same idea: permission to run as the machine's administrator. It is granted to a person rather than to an agent, by naming who may ask for it and on which channel; ask your assistant to set it up, as there is no page for it. What a run inherits from that is availability, not permission: a command still runs unelevated unless it asks, and the one level that lets a command run elevated without asking anybody is the one you set deliberately for work that must go through unattended. Take a name off the list and the next run feels it, with no wait for anything to expire.

An agent cannot grant itself any of this, or widen what it was given. Agents never change permissions, their own or another agent's, in any mode. One that needs more asks you instead: a card in your chat says what it wants, such as "Nova asks to let Helper use Everything", with Approve and No, and nothing changes until you approve.

It finds you where you are

You decide what reaches you and how loudly. Player One sorts what it sends into three levels, Urgent, Normal and Quiet, and you say which channels each goes to on Admin > Alerts (/admin/alerts). You connect the channels themselves on Admin > Messaging (/admin/channels); Channels and communication covers them.

The in-app bell is always included whatever routing you choose, so there is a record even when a channel is down.

Your passwords never go through the AI

"Here is the API key for the courier account."

Rather than take the key as text, the agent opens a masked field. Your browser sends the value straight into the encrypted vault, and the agent gets back only a reference: a handle it can pass to a command, never the value. Stored values are never displayed anywhere in Player One, not even to you. When a command needs the real key, Player One puts it inside that one process and scrubs it from anything that comes back.

When a website wants a human to sign in, "Log in to my supplier portal for me" opens a secure browser window in the preview pane beside the chat. You type the password and any two-factor code there and click Hand back. None of it passes through the AI.

Access is granted per agent and per project. Admin > Vault (/admin/vault) shows every grant, who created it and when it expires, beside a record of every use. If an agent asks for something it has not been given, the request waits for you, and answering it picks the conversation back up. Removing access blocks future use, though a value already handed to a running process cannot be pulled back. See Vault and sandboxing.

Each agent gets only what you allow

An agent you put in front of customers is sandboxed. It has no shell, no vault access and no general search of your systems, and cannot edit itself or create other agents. It works from its own instructions and whatever you deliberately share, and reaches an outside system only through a narrow tool you set up, with the credentials kept outside the sandbox.

What it is costing you

Admin > Usage (/admin/usage) has the totals, a chart over time and a breakdown by model and by agent, over today, the last 7, 30 or 90 days, or all time. The top bar carries a live meter for each connected account, so you can see what is left of your allowance. Keys your own software uses to call your models are made and revoked on Admin > API keys (/admin/api-keys); Build with it covers them.

There are two ways to pay for the AI itself. You can plug in a subscription you already hold, such as a ChatGPT plan: a flat monthly fee, usually subsidised, with the provider's own limits on how much you use. Or connect an API key and pay per token, which has no ceiling but produces a bill that follows the work. Tokens, cost and caching explains what a token is and how to spend fewer of them.

No single supplier owns your setup

Player One works with a wide range of AI providers, and moving between them is a dropdown rather than a migration. Admin > Providers (/admin/providers) shows one card per connected account, dragged into the order you want tried first; two accounts on one provider fail over in that order when the first is rate limited.

"Turn my work account off until Monday" parks a single account without signing it out. Nothing routes to it, the others carry the load, and the card reads a red Off until you switch it back on. Your agents' default model is on Admin > Agent Models (/admin/models), and any single conversation can be moved to another model from the picker beside the message box. Models and providers covers the rest.

When something goes wrong

Restarts resume interrupted work rather than dropping it. Stalled work is picked up again, and if it still cannot get going you are told. Stopping a job, from the Stop button on its page, pauses it rather than destroying it, so it can be brought back later with Resume with its team, files and history intact. One honest gap: a flow that is mid-run when your installation restarts is cleared rather than resumed, so it needs starting again.

You can take it all with you

Your work, memory and documents live in your own installation, not mixed into anyone else's. Admin > Backups (/admin/backups) exports a whole project, or just the parts you choose, as zip archives you download and can import elsewhere. Provider credentials and channel sign-ins do not travel, so you reconnect those. Chats travel with a project as their own tab in the archive, so a conversation moves with the work it belongs to. Back up and move your data has the steps; Your installation describes what the installation holds.