Answers that change nothing
Reading is the Assistant's default. Twenty-five of its sixty-six tools can only look — at threads, drafts, leads, files, knowledge, follow-ups, cases, opportunities and settings — and a question answered by those changes nothing at all. You can tell a read from a write without knowing any tool names: a read ends in an answer, a write ends in a card asking you to confirm.
The tools that can only look#
| Area | Tools |
|---|---|
| Anything, by search | find_anything, record_context, status, activity |
| Conversations and replies | list_threads, get_thread, list_drafts, read_draft |
| People and commerce | customer_360, list_leads, get_lead, list_opportunities, list_cases, next_best_action |
| Commitments and schedule | list_followups, list_schedules, list_owner_questions |
| What Connect knows | search_knowledge, recall |
| Files and the grid | list_files, read_file, ask_file, data_query |
| Configuration | list_mailboxes, get_settings |
None of those can write. That is a property of the tool rather than a mood the Assistant is in, which is why the guarantee holds even when a question is phrased as an instruction. Asking it to 'sort out the overdue follow-ups' produces a reading of which ones are overdue plus a proposal — not a silent pass through your commitments.
Telling one from the other#
- It ends in prose
- A read. The answer is the whole output and nothing is waiting on you.
- It ends in a card with arguments
- A write, proposed. Nothing has happened; the card is the request for permission.
- The status line says Done · N steps
- Either. The step count is work done, not changes made — a read that consulted six places also reports six steps.
- It ends in a refusal
- Neither. Something was out of the Assistant's authority and the refusal names which limit applied.
The step detail behind the status line is the precise answer when you want one. Unfold it and you see which tools ran; every name in the table above is a read, and anything else was a proposal you approved.
Why reads are the default#
An assistant that writes by default has to be right every time. An assistant that reads by default has to be right only when you agree with it, which is a far easier standard to meet and a far cheaper one to be wrong about. The cost of a mistaken read is a sentence you disagree with; the cost of a mistaken write is a message to a customer, a moved deal, or a commitment nobody made.
It also keeps the interesting question separate from the risky one. Most working questions — what did we agree, who has gone quiet, what is late, what does this file say — are answerable without changing anything, and answering them well is most of the value. Writes are the minority case and are treated as one.
What a read still cannot see#
- Another workspace. Every read goes through the tenant allowlist, the workspace kernel and row-level security. Data outside your workspace is invisible rather than forbidden.
- Sealed credentials. Provider secrets are sealed on save and never echoed back to a screen, which includes this one.
get_settingsreports configuration, not keys. - Deleted rows. A record removed is not readable by a tool that can only read. The decision log still holds what was done to it.
- The future.
next_best_actionis a recommendation built from evidence you can inspect, not a forecast. It answers 'what does the evidence suggest', not 'what will happen'.
Questions#
If I ask it to send something, could it send by accident?
No. Sending is a writing tool and every writing tool proposes first. Beyond that, an outbound message goes through the same send boundary a person's own send uses — so the channel's autonomy mode, the suppression list and the daily allowance all still apply after you confirm.
Does a read leave a trace?
The steps are shown in the conversation and the work is metered. The decision log is for decisions — approvals, refusals, actions — rather than for every lookup, so a question you asked is not a decision anybody has to account for later.
Can I stop it mid-answer?
Yes. The status line carries a compact Stop. Stopping a read leaves nothing half-done, because nothing was being changed; stopping during an action is a different matter and is covered by Running an action.