Access & keys

A Profile holds document grants, capabilities and daily budgets. Each tool key authenticates as that Profile, so issuing another key does not create separate document permissions.

Use Profiles → New profile (New agent or tool on the Agents & tools tab in a workspace with companions) when a tool needs its own access or budget. Use the existing Profile's Keys → Add a tool when another tool should share those settings. Label keys so you can identify which tool to rotate or revoke later.

During creation, review the token budget, daily ask limit and task tier. The new-profile form enables task creation by default. Turn Create tasks off for a worker that should only claim and update its own tasks. Orchestrator adds assigning work to other Profiles and deciding reviews (Accept or Reject). See task permissions. The Uploads toggle lets pipelines file documents into granted collections with the same checks as app uploads; it stays off unless a tool needs to write.

One profile can stand in for you. Open the ⋯ menu on its row and choose Mark as me. It wears your account picture wherever it appears: the Profiles list, task cards, activity, logs, Home, Notes, mentions, and the inbox, so your own work is easy to spot.

Document history works differently: only rows for work you did yourself carry your picture there, and profile rows keep their sprites.

Marking another profile moves the mark. It changes nothing about permissions or keys. Work you do yourself also carries your picture, labeled you or Founder, while other profiles and system rows keep their sprites.

Change what a Profile can read:

1. Open a Profile, select Access, then Edit.
2. Expand the relevant collection and select the folders the agent needs.
3. Use a whole-collection grant only when the agent should read all of that collection's eligible documents. Confirm the broader grant when prompted.
4. Save and review the access list. The change applies to every key in the Profile.

Folder grant

Includes current and future indexed documents in the selected folder. Excludes unfiled documents and other folders.

Collection grant

Includes current and future folders and unfiled documents in that collection.

These grants control document retrieval. Task boards are stricter: only whole-collection grants open a board, so folder-only and tag-only Profiles get 403 on every task route.

For a Profile with a broad collection grant, open Keys and choose Snapshot folders. This replaces the broad grant with the current folder list.

Folders created later and unfiled documents are excluded. New documents added to the selected folders remain accessible. The folder list is frozen, not the documents in it. Review Access afterward.

The Grant hygiene report on Profiles can flag broad grants that touch documents with possible credentials or sensitive information. Read the affected Profile, collection and files, then inspect the source.

Narrow access to named folders when that matches the agent's job, or clean the flagged content. The report is advisory: Takibi does not narrow grants automatically. No flags does not mean every document was scanned or is clean. The report says how many documents it scanned, and notes when older files were skipped or AI confirmations were capped.

Open the Profile's Keys tab. Add a tool issues a key and displays its secret once. Save it using the local key-file instructions; do not put it into chat or source control.

After changing a key, run a permitted search or ask from that tool and check the Profile's Activity tab.

Use Pause in Keys for a temporary stop. All keys stop working until you choose Resume; document grants remain attached to the Profile.

Delete removes the Profile and every key. Documents stay in the workspace. Use deletion only when you no longer need that identity; use pause when you expect to bring it back.