Suggest policies from current access
The Suggest from current access panel on the Policies page mines the scopes your team’s agents already hold and drafts one policy per owner. You review each draft, optionally edit, and save (or discard) — nothing is written until you click Save in the editor.
This exists because the blank policy editor is a cold start. After a few months of running agents you already have de-facto policies — they’re just implicit in the scope grants on each agent. Suggest surfaces them as explicit policy rows you can govern.
How it works
- On
/policies, find the Suggest from current access panel (full-width when you have no policies yet, a compact strip once you do). - Click
Generate suggestions. AgentValet scans every agent grouped by owner and produces one draft policy per owner — typically anallowrule list mirroring the union of that owner’s agents’ scopes. - The panel shows one row per owner: their name, email, and the number of scope rules in the draft.
Open as drafton any row launches the policy editor pre-populated with that draft. Edit the name, tweak rules, save — or close without saving to discard.
Suggestions are read-only previews. The Suggest panel does not write any policies on its own — every save goes through the standard editor with the live allow-list preview.
The PII banner
If any owner currently holds scopes tagged pii, the panel surfaces an amber banner at the top:
“N of M owners currently hold PII-tagged scopes. Consider adding a guardrail: deny tag:pii for members.”
This is a recommendation, not an automatic action. Click the link to jump to Guardrails and add the rule yourself — the system never silently introduces a new guardrail.
The banner is intentionally separate from the per-owner drafts because guardrails apply org-wide and need a deliberate decision, not a per-owner toggle.
When suggestions are empty
If no owner has any agent scopes yet, the panel shows: “No agent scopes to mine yet. Once your team connects platforms and grants scopes to agents, suggestions will appear here.” — connect a platform and grant a scope first, then re-run.
Re-running
Clicking Generate suggestions again recomputes from the current state. Suggestions are not cached — each run reflects the live agent permission matrix.