Agents

An Agent is a workspace worker that takes one goal and executes it as a durable, inspectable run. The Workspace Agent and every custom agent are pinned to an immutable version — instructions, model, tool policy — so a chat already in flight never changes underneath you.

Ongoing sessions (staff dev preview)

Staff on the dev deployment can open Agents → Workspace Agent → Sessions, or the Sessions tab of a custom Agent. Each session is a separate continuing job with its own goal, conversation, memory, schedule and spend caps.

Choose Campaign monitor, Lead replenishment, Reply handling, Deliverability, Account research, Inbound qualification, CRM hygiene, Pipeline review or Custom job. Select exact native resources and create a draft. Describe the job in chat or edit its settings; proposed settings need your review. Draft chat uses the entered credit caps and cannot perform writes. Review activation shows the exact version, resources, standing actions, schedule and budgets. Approve and activate grants that scope once. Later scope changes pause work and require another review.

Every check reserves the per-run cap against the rolling 24-hour cap and optional lifetime cap. Confirmed costs replace the hold; uncertain costs remain held. A session can choose its next check within the earliest/latest bounds. It waits when its daily budget is full and pauses when its lifetime budget is exhausted. Pause, Resume, Complete and Archive preserve its conversation and run history. Run links show detailed actions, costs and approvals.

oxygen agent session templates --slug workspace --json
oxygen agent session create --slug workspace --config-json '{
  "title": "Campaign monitor", "goal": "Review this campaign each day",
  "template": "campaign-monitor",
  "resources": {"sequences": ["<campaign-id>"], "tables": [],
    "conversations": [], "mailboxes": [], "records": [], "objects": [],
    "knowledge": [], "domains": []},
  "actions": [], "events": [],
  "schedule": {"interval_minutes": 1440, "min_interval_minutes": 60,
    "max_interval_minutes": 10080},
  "budget": {"per_run_credits": 5, "daily_credits": 20}
}' --json
oxygen agent session get --slug workspace --session <session-id> --json
oxygen agent session preview --slug workspace --session <session-id> --json
oxygen agent session activate --slug workspace --session <session-id> \
  --revision 1 --preview-token <token-from-preview> --approved --json
oxygen agent session run --slug workspace --session <session-id> --json
oxygen agent session webhook --slug workspace --session <session-id> --json
oxygen agent session pause --slug workspace --session <session-id> --json
oxygen agent session resume --slug workspace --session <session-id> --json

run starts an active session's next check now, within its caps. webhook returns a URL and a secret, shown once; another tool posts a JSON object to the URL with the x-oxygen-agent-webhook-secret header (add x-oxygen-delivery-id so a retry counts once), and each delivery wakes the active session within its caps. A delivery comes from outside your workspace: from its first one on, the session asks before every external write. Run webhook again to rotate the secret, or pass --remove to delete it.

Use oxygen agent session create --help for flags. Pass the configuration as JSON directly; MCP exposes the same operations as oxygen_agent_session_*. Configuration needs title, goal, template, exact resources arrays, actions, events, schedule (interval, minimum and maximum minutes), and budget (per_run_credits, daily_credits, optional lifetime_credits). ends_at is optional. Only selected resources and reviewed native actions qualify for standing authority. Workflows remain the deterministic orchestration primitive; generic workflow dispatch, browser/voice autonomy and autonomous delegation are outside this preview.

Production and restricted client logins cannot access this preview. Existing specialists and manual Agent chats keep their existing entry points.

The roster

oxygen agent list shows the built-ins, oxygen agent custom lists yours. oxygen agent enable <slug> and disable <slug> accept built-in slugs only; a custom agent is retired with oxygen agent delete <slug> (archive — versions and runs are preserved).

Tool authority is not spend authority

A published version grants standing tool authorization. It grants no money.

Tool access is set per version. On /agents/new and on the Settings tab, the Tool access picker offers four presets:

The CLI equivalent is --tool-policy-json on agent create / agent set, with --confirm-full-access for "mode":"full".

Spend is authorized separately, every time:

• A manual run requires an explicit ceiling. oxygen agent run makes both --max-credits and --approved required flags — there is no unbounded run, and no version setting removes them.
• A cron, event, or webhook trigger persists a per-delivery ceiling: oxygen agent trigger-create also requires --max-credits and --approved, and each firing is bounded by that number, not by the run before it.
• Your plan sets a default Agent run ceiling. A --max-credits above it needs one more approval, for that run or trigger only: --approve-above-default on the CLI, approve_above_default: true on MCP, and a confirmation card in the web app. Without it the request is refused with approval_required (details.approval_kind: agent_ceiling_above_default), and nothing starts.

Four things are enforced outside the model and cannot be prompted away: a platform deny list (agent self-management, credentials and secrets, billing, admin, support, Copilot, org selection, integration connect/disconnect, directory publishing); a scoped policy denying anything it does not explicitly match; full mode denying everything until standing authorization is recorded on the version; and the per-run credit ceiling. A run spends at most its approved --max-credits, and never more than the default ceiling unless you approved the higher number for it. oxygen limits show --json reports the default as spend_safety_defaults.agent_run_max_total_credits (and agent_run_max_inference_credits for the run's own model calls), and the pricing reference lists every size's. No approval goes above agent_run_approved_max_credits (25,000 credits), and the balance check, the daily spend guard and the run's upstream-cost, step and time bounds still apply. Grandfathered Starter, Pro, and Team keep the size their price maps to; Enterprise uses the $1,999 plan default. A paid tool call that arrives without its own credit cap is refused with agent_paid_capability_requires_max_credits.

Create one

Web: /agents → New agent → /agents/new. Fill Name, System prompt, Model (Oxygen Fast, Oxygen Balanced — the default — or Oxygen Max), and Tool access, then Create agent. The slug is generated from the name.

CLI — free, starts no run, spends nothing:

oxygen agent create lead-research \
  --name "Lead research agent" \
  --instructions "Research inbound signups and write a one-paragraph brief onto their CRM record." \
  --model-policy-json '{"level":"medium"}' \
  --tool-policy-json '{"mode":"scoped","rules":[{"decision":"allow","effect":"read"}]}'

Editing configuration publishes a new immutable version. On /agents/<slug>?tab=settings that is the Save settings button; from the terminal it is oxygen agent set <slug> --instructions "…". Chats already running stay pinned to the version they started on.

Run it

oxygen agent run is the paid entry point — it starts the run and its spend.

oxygen agent run lead-research \
  --goal "Brief the five newest inbound signups" \
  --max-credits 200 --approved

In the web app, the Chats tab on /agents/<slug> has Start a chat: a Prompt box, a Maximum credits input, and the Start chat button. Starting approves managed inference and permitted tool actions up to that ceiling — nothing above it. A maximum above your default Agent run ceiling opens a card naming both numbers; Approve and start approves it for that chat only.

oxygen agent runs lead-research --json          # newest first
oxygen agent run-get lead-research <run-id>     # append-only event ledger
oxygen agent cancel lead-research <run-id>

Each run has a transcript at /agents/<slug>/runs/<run-id>. When an ask rule pauses a tool call, decide it there with Approve and resume or Reject, or from the terminal:

oxygen agent approval-decide lead-research <run-id> <approval-id> --decision approved

Triggers, files, MCP

Triggers have no web screen. oxygen agent triggers workspace lists them; oxygen agent trigger-set workspace <trigger-id> --status paused stops deliveries without deleting one. A new trigger carries its standing per-delivery ceiling:

oxygen agent trigger-create workspace --type cron \
  --cron "0 9 * * 1" --timezone Europe/Berlin \
  --instruction "Summarize last week's replies" \
  --max-credits 100 --approved

Attach text context with oxygen agent file-create --name notes.md --text "…", list it with oxygen agent files, pass it to a run with --file-ids.

The agent MCP tools (oxygen_agent_run, oxygen_agent_approval_decide, and the rest) are not in the default set a fresh client sees. Reconnect with ?toolset=agents to load them; they are listed in the MCP reference. An agent can never manage or run agents through them: create, update, delete, enable, disable, run, cancel, approval-decide, and trigger create/set are all on the platform deny list.

Related

• Approvals — how a paused ask rule is decided.
• Runs — the durable record an agent run produces.
• Modes — the gate on the tools an agent calls.