Permissions and safety

The agent works inside the same permission model as the dashboard and adds a preview step before any change to your program.

Roles

For a signed-in user, the agent can do only what that user’s role allows on the site it works on.

Role	What the agent can do for you
Read	Reporting, campaign and settings visibility, purchase tracking, product questions, running skills
Customer Support (CSP)	Person, referral, and coupon lookups and support actions
Write	Read, plus support actions, report exports, App Store integrations, and campaign and Wallet pass building and editing (Early access)
Admin	Write, plus user management

The Customer Support role is made for support teams: lookups and support actions, without access to campaign settings or reports.

Credentials and scopes

• Users sign in with OAuth 2.1 with PKCE. Clients register themselves, you approve the connection once in your browser, and you can revoke it from My Profile → Connected Apps.

• API keys are for scripts, automations, and agents that cannot sign in interactively. You create a key with mcp:read, or mcp:write if it needs to change data, either as a personal key that follows your own access or as a key scoped to one site or the whole account, which keeps working as people come and go. Keys do not expire, are shown once, and are revoked from My Profile → API Keys or Account settings → API Keys & MCP.

• Account isolation. A credential reaches only the sites of its own account. A site from another account is never accessible.

Preview, approve, apply

1. The agent proposes a change and shows exactly what will happen: settings before and after, or a diff for templates.

2. You review the preview and approve it.

3. The agent applies exactly the previewed changes and nothing else, and records them under your name. If you change your mind or ask for something different, the pending change is discarded and the agent proposes a new preview.

Support actions such as approving a referral or anonymizing a person run only after you confirm them in the conversation. Report exports and generated images return their result in the conversation and change nothing in your program, so they run without a preview.

Build in test mode, launch when ready

The agent creates campaigns in test mode and makes its content changes there, so you can review a campaign exactly as customers will see it, run test purchases, and iterate before anything is live. Placements, A/B tests, coupon lists, site settings, test purchases, and pass publishing apply to your live program and are always previewed. When a campaign is ready, the agent checks launch readiness and gives you the link to the launch form. Launching is your decision.

What the model never decides

Eligibility, fraud checks, reward issuance, and coupon assignment are decided by Talkable’s deterministic logic, the same code that runs your program today, never by the model. The agent can approve or void a referral you point it at, but it does not decide who qualifies or issue rewards on its own.

What the agent won’t do

• Launch a campaign, or change the content of a live campaign.

• Delete a campaign, a placement, or a person’s data outside an explicit anonymization request.

• Issue a reward, decide eligibility, or score fraud on its own.

• Read another site’s data, or act for shoppers.

Logging

Every agent action is recorded with who asked, which tool ran, when, the outcome, and the source: the dashboard or MCP. Previews that were not applied are recorded too. Program changes land in the site’s Settings Changes history under the name of the person who approved them.

MCP

An agent connected over MCP uses the same tools and the same role checks. A read-only credential never sees write tools. A write credential applies changes immediately, without the preview, so grant it only to agents that need it. A task delegated to the Talkable assistant over MCP runs with the credential’s permissions and applies its changes without waiting for approval. See Permissions and isolation.

Data handling

• The agent reads the data of the site it works on, limited by your role or your key’s scope.

• Each conversation runs in an isolated environment with no access to Talkable’s internal network or secrets, and sensitive values are redacted from what the model sees.

• Conversations, tool calls, and feedback are stored with your site.