Bind ownership at registration.
An agent carries a named owner and scope rather than borrowing an untracked service account.
← Back to Home
Internal Agents
Give every workday an accountable agent.
Register internal agents as Business deployments, choose their connected tool scopes, and assign the members or groups who may use them.
Employee access, carried into every call01 / 04Pick the tools
Select tools. Watch permissions take shape.
Available tools Scope mode
Calendar
✓calendar.read
○calendar.write
Drive
✓drive.read
Agent configuration · tools and scopes
Configure the internal agent’s tools and scopes before making it available to employees.
A CLOSER LOOK
One agent identity. Access configured for your employees.
A wider agent grant cannot expand an employee’s authority. The effective toolset is the intersection of both permissions.
Employee access matrixRoles
| Requested operation | Agent grant | Elena · Sales | Omar · Support |
|---|---|---|---|
| Read a customer account | Granted | Available | Available |
| Draft customer email | Granted | Available | Unavailable |
| Update a support ticket | Granted | Unavailable | Available |
| Delete a customer account | Not granted | Not offered | Not offered |
Separate routine and sensitive actions.
Read, draft, update and delete can have different grants. An action outside the effective scope is not offered to the agent.
Keep the history after offboarding.
When an employee loses access, their agent loses delegated authority. Earlier activity remains available for investigation.
Keep the workflow. Add accountability.
Bind the agent to its employee.
Registration associates an owner with each agent. Tool calls carry the agent and user identities.
Keep sensitive actions out of reach.
Grants can reach down to a single action. An ungranted tool is not offered to the agent.
Respect team boundaries.
An agent working for Sales cannot borrow another team’s private access.
End access when employment ends.
Offboarding removes access while the record of previous activity remains available for review.
Rolling out employee agents
Must employees adopt a new assistant?
Fabriq sits between the agents employees use and the connected systems they reach. Existing workflows can use the governed endpoint.
How do administrators stop an agent across the organization?
Disable the agent at the organization level. Subsequent access is refused; coding-agent sessions also have explicit session revocation controls.
What should we examine during a pilot?
Start with a named owner and a small task. Inspect the exposed tools, test an out-of-scope action, and review both identities and verdicts in the audit trail.