How granular are permissions in Blits.ai?

The platform has 62 separate permissions, checked on every API call, so you can decide per role who may edit flows, run tests, view conversations or export logs.

Can we audit what an agent did?

Yes. The decision log shows per conversation which tools ran with which inputs, which guardrails fired, who approved what and which model answered, and it exports as JSON or over OpenTelemetry. Workflow runs store every tool call and result.

Can a person approve an action before the agent executes it?

Yes. By default, tools that move money or change data wait for approval from the customer or an employee before they run. Per tool you can change that to automatic or disable the tool. Approvals, rejections and timeouts are logged.

Can traces and the decision log be switched off?

Yes. Both are on by default, with sensitive values masked and a retention period. Where regulation or your own policy requires it, they are switched off or shortened per agent. Audit logs, workflow run records and approvals are always recorded.

Security and governance

Q: Is custom code sandboxed?

Yes. Code functions run in an isolated sandbox with a 128 MB memory limit and a one second timeout, after a check for blocked patterns.

Agents that act in your systems need limits, oversight and a record of what they did. This page describes the permission model, how code and tools are contained, where people approve, and what is logged.

Each capability is marked as on by default or configurable per assistant, workflow or tenant. Defaults that touch customer data can be switched off where regulation or your own policy requires it.

Who can do what

Access to the platform is checked on every request.

62 separate permissions

On by default

Every action in the platform, from editing a flow to exporting logs, has its own permission. Permissions are checked on each API call, and tenant administration is limited to tenant admins.

Tenants kept apart

On by default

Each tenant has its own users, assistants, knowledge and data, and every request is scoped to the tenant of the signed in user.

Keys stored encrypted

On by default

API keys for your own model endpoints and credentials for connected systems are stored encrypted.

Contained execution

What an agent can touch is limited by design.

Sandboxed code

On by default

Custom code runs in an isolated sandbox with a 128 MB memory limit and a one second timeout, after a check for blocked patterns.

No access to internal networks

On by default

The web browser tool refuses internal and private network addresses, so an agent cannot be used to reach systems behind the firewall.

Structured database access

On by default

Agents query SQL storage through structured filters. The model never writes raw SQL against your data.

Limits on runs and tools

On by default

Tool calls share a time budget per turn, and every workflow run has a maximum number of steps and a maximum duration.

Human oversight and guardrails

People decide where the agent may act alone and where it may not.

Approval per tool

On by default

Tools that move money or change data require approval by default, and read only tools run automatically. Each tool can also be set to automatic or disabled. Approval comes from the customer in the conversation or from an employee, optionally only above an amount, and an unapproved tool never runs.

Switch it off per assistant where regulation or your own policy requires it.

Input and output guardrails

Configurable

Checks on what the user asks and what the agent answers, regex rules, blocked topics and a quality check, configured per assistant. A content scanner runs on every assistant.

Personal data masking

Configurable

Personal data in conversations can be masked before it is stored or sent to a model.

Handover to people

Configurable

Conversations move to a live agent in Salesforce, Zoho SalesIQ or Freshdesk when the agent should not continue.

Audit and monitoring

Every relevant action leaves a record you can review and export.

Audit log of user actions

On by default

Changes and sign ins by platform users are logged, and tenant admins can export the audit log as CSV.

Audit trail of agent actions

On by default

Scheduled agent tasks keep an audit trail of every status change and approval, and every workflow run stores the tool calls it made and what they returned.

Traces per conversation

On by default

Traces record the tools called, the documents retrieved, guardrail hits, provider fallbacks and regenerations for each turn.

Switch it off per assistant where regulation or your own policy requires it.

Decision log with SIEM export

On by default

Per conversation, a timeline of routing decisions and their source, tool calls with masked inputs and results, guardrail checks, approvals and the model used. Export it as JSON or stream it over OpenTelemetry to your SIEM.

Switch it off per assistant where regulation or your own policy requires it.