Cloud agents
How an AI worker gets tool access
The interesting part of tool access is not the list. It is where the credential lives and who can read it.
The short answer
Giving an AI agent tool access means storing a credential the agent's server-side runtime can use and the client never sees. Polaris ships a fixed catalog of fourteen connections, validates each credential live against the provider's own API before storing it, and keeps it in a table with no select policy, so no browser can read it back. Web search needs no credential and runs in every session.
- Connections in the catalog
- 14
- Credential scope
- One per organisation
- Client read access
- None
The catalog, in full
Fixed list. Nothing outside it is connectable today.
Communication
Slack for channels, messages and task signals. WhatsApp for chats and customer messages. Gmail for reading and sending mail.
Knowledge and design
Notion for pages and databases. Google Drive for documents, sheets and files. Figma for design files and comments.
Engineering
GitHub for repositories, issues and pull requests. Linear for engineering issues. Supabase for a product database and its auth.
Commercial
Stripe for payments and invoices. HubSpot for CRM contacts and deals. Instagram for posts and engagement data.
Time and the open web
Google Calendar for events and scheduling. Web search for open research, which is the one entry needing no credential at all.
What connecting actually does
- 1
An owner or admin starts it
Only members with the owner or admin role can write a connection credential. Row-level security enforces that on insert, update and delete.
- 2
The credential is checked against the provider
A server-side function calls the provider's own API with the token before anything is stored. Slack is checked with an auth test, GitHub by fetching the user, Notion by reading the integration, Linear with a viewer query, Stripe by fetching the account.
- 3
A failure is reported honestly
If the provider rejects the token the connection does not become connected. The error names the provider and what it said, rather than optimistically saving and failing later inside a job.
- 4
Storage has no way out
Verified credentials go into a table with insert, update and delete policies for admins and no select policy for anyone. The client API cannot return the secret, including to the person who pasted it.
- 5
Status without exposure
Members can call a function that lists which connections hold a live credential. It returns names, never secrets, which is how the interface shows a connection as connected without ever handling the token.
What runs inside the session today
Being precise about this matters more than sounding capable. Inside a task session the runtime exposes live web search, capped at eight uses, plus five tools it implements itself: post a progress comment, tick one acceptance-criteria item, attach a file, draft a document into the shared tree, and deliver. A review session swaps in tools for updating a file or document in place and resolving individual comments, with web search capped at five.
Connections are the credential layer underneath that. Each is authorised once, org-wide, and stored where only server-side code can reach it, and each worker carries its own list of the connections it is meant to use. If a page tells you a worker is already posting to your Slack channels unattended, check it against the runtime rather than the marketing.
How each credential is obtained
Where the human goes to get the token, per provider type.
| Connection | Credential type | Where it comes from |
|---|---|---|
| Slack | Bot token | Your Slack app, OAuth and Permissions |
| GitHub | Fine-grained personal access token | GitHub developer settings, scoped to the repos needed |
| Notion | Internal integration secret | Notion integrations, with pages shared to it |
| Linear | Personal API key | Linear API settings |
| Stripe | Restricted key | Stripe dashboard, read-only scopes recommended |
| Figma | Personal access token | Figma account settings |
| HubSpot | Private app token | HubSpot settings, integrations |
| Gmail, Drive, Calendar | OAuth | Google, through the authorisation flow |
| Web search | None | Available in every session |
Related reading
Web search in Polaris
Nothing to authorize, nothing to store, and every query a worker runs appears in the activity feed while it works.
Connect Slack to Polaris
Six scopes, no access to direct messages, and a bot that only reads the channels somebody invited it into.
Connect GitHub to Polaris
Fine-grained tokens let you hand over three repositories instead of an account, which is the whole reason to use them here.
Skill files, and why a worker's capability should be readable
The difference between a prompt and a playbook is that one of them is a document your colleague can edit.
Model Context Protocol (MCP)
One protocol between models and the systems they need, instead of one integration per pair.
Questions people ask
+Can I connect a tool that is not in the catalog?
No. The catalog of fourteen is fixed in the product today and there is no custom connection form. If the tool you need is missing, the honest answer is that Polaris cannot reach it yet.
+Is the credential per worker or per organisation?
The credential is stored once per organisation and per connection, so one Slack token serves every worker in the org. Each worker separately carries the list of connections it is intended to use, which is a configuration of scope rather than a second credential.
+What stops a worker using a connection it should not?
Two things: the connection list on the worker, and the scope of the credential itself. The stronger control is the second one. A read-only restricted key cannot be talked into writing, whatever a prompt says, which is why the catalog hints recommend restricted scopes where the provider offers them.
+Does the agent need my Anthropic key too?
An organisation can store its own Anthropic key, in a separate table with the same write-only trust model and no select policy. The runtime looks up the org key when it claims a job and falls back to the key configured on the machine.
+How do I revoke access?
Delete the connection credential, which owners and admins can do, and revoke the token at the provider. Because the credential is stored once per organisation rather than copied per worker, there is one place to remove it.
Related
Cloud agents that keep working after you close the laptop
For the person whose agent is brilliant, local, single-player, and dead the moment the lid goes down.
Skill files, and why a worker's capability should be readable
The difference between a prompt and a playbook is that one of them is a document your colleague can edit.
Cloud agents versus local agents
Most teams end up running both. The useful question is which work belongs where.
The audit trail behind every agent session
If you cannot reconstruct what happened three weeks later, you do not have an audit trail. You have a feeling.
Web search in Polaris
Nothing to authorize, nothing to store, and every query a worker runs appears in the activity feed while it works.
Connect Slack to Polaris
Six scopes, no access to direct messages, and a bot that only reads the channels somebody invited it into.
Connect GitHub to Polaris
Fine-grained tokens let you hand over three repositories instead of an account, which is the whole reason to use them here.
Model Context Protocol (MCP)
One protocol between models and the systems they need, instead of one integration per pair.