# Agent capabilities and approvals

> Tell apart what an Agent may read and organize directly, what it runs from local capabilities, and which high-impact actions need your approval.

- Source: https://www.getbeav.com/en/docs/agent/capabilities-and-approvals

Every Agent connection should read the local manifest first. The public docs describe the stable flow; the local manifest describes what this build can actually do.

## Usually fine to proceed

* Read the public manifest and guide.
* Create or reuse an ACP session.
* Submit source retrieval, topic planning, content creation, draft, and planning tasks.
* Poll run status and events.
* Read the artifact references already returned.

## Depends on current capabilities

* Image, video, and audio generation.
* Media processing and export.
* Browser page actions.
* Project packaging and cross-app delivery.

An Agent should never infer that these are available from what this website advertises. The local manifest, guide, and actual run results are the only truth.

## Always wait for approval

These actions can cost money, change external state, or produce irreversible results:

* Paid generation.
* Browser control.
* Deleting content.
* Publishing to an external platform.
* Writing or exporting files outside Beav.

When a run returns `awaiting_approval`, the Agent should explain which capability and task are waiting, and must not work around the approval by resubmitting, switching interfaces, or turning off safety settings.

## Token safety

* Provide the token through `REDBOX_ACP_TOKEN` or the Authorization header.
* Never put the token in prompts, web pages, query parameters, code, docs, or logs.
* Never upload the local discovery file to a public service.
* Never fix a connection problem by moving the Gateway from a local listener to a public one.

## When a task counts as done

An Agent may report a task complete only when the run has finished, the result status is explicit, the required artifacts can be read, and the follow-up session ID has been saved. Successfully sending a request is not the same as finishing a creation task.