Other AI agents

Off until you turn it on. Nothing is offered to agents until an owner or admin turns on Settings → Guide behavior → Other AI agents. Answering and showing then start on; asking for actions stays off until you turn it on separately (it asks for your second factor). Turning Other AI agents off keeps each tool’s switch as you left it, so turning it back on while asking for actions is still on asks for your second factor too.

Release preview: agent tools are implemented and tested in the repository and reach the hosted script with its next release. Feature-detect with typeof window.Puntego?.assist === 'object'.

​

The three tools

{ "type": "object", "properties": { "question": { "type": "string", "minLength": 1, "maxLength": 1000 } }, "required": ["question"], "additionalProperties": false }

​

How a write stays governed

• Only do_action can lead to a write. On ask and show_me turns the guide withholds every write declaration and every write action template, and ask never takes the person to another page.
• The visitor approves every write, on the page. The guide’s existing confirmation card opens with the line “An AI agent asked for this. Nothing changes unless you approve it here.” — even for writes a visitor’s own request would run without asking.
• Payments, signatures and deletions are always refused for an agent. On every plan, a write that pays, signs or deletes (your target’s class, or the automatic detection on the live page) is never prepared for an agent’s request. The guide points the visitor at the control instead (“Show me”) so they can do it themselves, and do_action returns not_done with error.code: "high_risk_refused". The same applies to a Verified Action whose own words say it pays, signs or deletes.
• Only a real press counts. The card lives in the guide’s closed shadow root and accepts only a press the browser marks as the person’s own. Page script, runTurnAction, respondToProposal, retryTurn and synthetic events never approve or re-send an agent’s request. An agent that drives the browser’s own mouse and keyboard (browser automation, computer use) already acts with the person’s full input on every page, and no page can tell its press from theirs: this guarantee is about agents that use the guide’s tools, not about software that controls the browser.
• The same rules as for visitors. Your targets and actions, your plan’s limits, elevated actions only from Growth, and every refusal rule apply unchanged. In test mode writes become “Show me”, as for visitors, except on a domain you verified.
• Honest results. do_action returns the receipt the page or your site verified (receipt.verified), “sent, not confirmed here” when the page could not confirm it, or what happened instead: declined, shown_instead, not_done (with high_risk_refused for a payment, signature or deletion), failed or awaiting_person. A receipt is delivered once, to the call that caused it.
• Requests your team approves. When an action needs your team’s approval (Guides → Actions → “Require workspace approval”, or an action that always asks you), an agent’s request never reaches your team on its own: the guide shows the person Send request to the team, and only their own press sends it to your approvals inbox (and to Slack and email). Until then nothing is stored in your inbox and do_action reads awaiting_person; if they cancel, declined. A tool call alone cannot fill your inbox; the Worker also caps how many such requests one visitor and one workspace can send. Once sent, the guide tells the person it went to your team. do_action keeps waiting in case you approve within the wait (then done); otherwise it returns awaiting_person with a summary that says your team decides, or not_done with error.code: "owner_declined" when your team does not approve it or it expires.
• The agent’s words are data. They reach the guide as the visitor’s question, marked as coming from an agent: they cannot change the guide’s rules, grant a permission or confirm anything.

​

WebMCP

• the visitor’s consent allows the assistant where your consent settings ask for it, and
• the page is not in privacy-only mode or on a route the guide is excluded from.

​

From your own code: window.Puntego.assist

// The tools this page may use right now: [] while off or before consent.
const tools = window.Puntego?.assist.tools() ?? [];

// Ask in words and get the typed turn (answer, blocks, sources, follow-ups, proposal).
const { status, turn } = await window.Puntego.assist.query({
  question: 'Which plan includes SSO?',
  open: false, // true also opens the guide so the person sees the answer
});

// Dispatch a framework's tool call.
const result = await window.Puntego.assist.handleToolCall(
  { name: 'do_action', arguments: { request: 'Turn on weekly digests' } },
  { waitMs: 120_000 }, // how long to wait for the person (5 s – 10 min)
);
if (result.status === 'done') console.log(result.receipt); // { verified, text, action, id }

​

Usage, limits and the audit log

• Metered like visitor questions. Every agent call is a turn against your plan’s answers; a write counts against the plan’s actions, like a visitor’s.
• Per visitor session: at most 10 agent calls a minute and 120 an hour (429 with Retry-After beyond that).
• Audit log: every call appears in Audit log as Other AI agent: the tool, whether it was accepted or refused and why. The row holds no question, answer, visitor or conversation; an action the visitor approved has its own row with the verified result.
• Who turned it on: turning Other AI agents (or any of its tools) on or off is listed under Audit log → Workspace settings, with who did it and when, like every other switch in Settings.

​

Next steps

• Guide tools SDK for driving the guide from your own code.
• Verified Actions for actions that run on your systems.
• SDK reference for the full assist surface.