> ## Documentation Index > Fetch the complete documentation index at: https://docs.codenullapp.com/llms.txt > Use this file to discover all available pages before exploring further. # Agent Permissions > How the AI Designer, AI Search and AI Transactions permissions decide what the Codenull Agent can do The Codenull Agent does not look at your role's permissions directly. Your session is treated as an [MCP API key](/configurations/mcp-server) that asked for every scope, and the same policy that governs API keys decides which scopes survive. The agent then mounts only the tools behind the surviving scopes. A tool you cannot use is not refused: it is simply not there. Flow from the user session to the agent permissions, the enforcement gate, the MCP scopes and the tools the agent mounts ## What each permission unlocks | Permission | Scopes | Tools | Condition | | - | - | - | - | | **AI Designer** (`agent-designer`) | `config:read`, `features:write`, `tables:write`, `menus:write`, `decisions:write` | Explore and read features, hooks, tables, menus and decisions. Create and edit features, tables, menus and decisions. Validate code. Read the GraphQL schema. | None. | | **AI Search** (`agent-search`) | `data:read` | `execute_data_query` and `get_graphql_schema`: find, count and aggregate records. | Per-entity permission enforcement enabled for the application, unless the user is an admin. | | **AI Transactions** (`agent-transactions`) | `data:write` | `execute_data_mutation` (create, update, upsert; never delete) and `get_graphql_schema`. Every mutation waits for your confirmation. | Same as AI Search. | | **Admin** role | Everything above plus `hooks:write`, `roles:write`, `env:write`, `config:delete` | Hooks, role permissions, environment variables, and deleting features, hooks and decisions. | None. Admins never pass through the gate. | Permissions add up. A designer who also has AI Search gets the configuration tools plus data reads. A role with only AI Search gets exactly two tools: the data query and the schema. ## The enforcement gate `data:read` and `data:write` only survive when the application enforces per-entity permissions. Without enforcement, the GraphQL resolvers only check that the caller is authenticated, so those two scopes would give the agent every table in the application regardless of the user's role. Rather than take that risk, the platform drops them. What a non-admin user sees in an application **without** enforcement: * **Only AI Search or AI Transactions.** No scope survives. The chat answers that an administrator must enable per-entity permission enforcement for the application before queries and transactions work. It is not a missing-permission message: the role does have the permission. * **AI Designer plus AI Search.** Configuration tools work as usual. When the user asks for data, the agent explains the same cause in that turn instead of guessing. * **Admin.** Unaffected. Admins already bypass entity permissions, so they keep the data tools. A user with none of the three permissions gets a plain "no permission" answer in every case, naming the permissions that would grant access. Enforcement is an application setting managed by your administrator (`PERMISSIONS_ENFORCEMENT_ENABLED`). Enabling it also activates per-entity and per-feature permission checks across the whole application, not only in the chat. The [MCP server](/configurations/mcp-server#scopes) page describes the same rule for API keys. ## Two layers, two different questions * **Agent permissions decide which tools are mounted.** This is the flow in the diagram. It happens once per chat turn, from your role. * **Entity and feature permissions decide which tables and records those tools can reach.** They run inside `execute_data_query` and `execute_data_mutation`, in the same GraphQL resolvers your application uses. They exist only when enforcement is enabled, which is why the first layer requires enforcement before handing out the data tools. ## Operations that wait for your approval Whatever the permission, these writes never run on their own: hooks, environment variables, role permissions, every deletion, and every business-data mutation. The agent shows a confirmation card with the exact arguments. Features, tables, menus and architecture decisions apply directly and show the diff of what changed. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.