An agent that respects permissions

You’ll build an AI support assistant that customers use inside your app. The hard part isn’t the model; it’s making sure the assistant can never show Ada someone else’s orders, never refunds without a person saying yes, and never runs up a bill. Pawabase does that with three settings, which this guide walks through. You’ll use: agents, knowledge bases, access rules, approvals and limits. Before you start: a chat model named chat and an embedding model named embed (Providers and models), and an orders table with the Record owner rule from An app with signed-in users (with customer_id as the owner field).

How it works

Concern	Setting	Effect
Only the asker’s data	Hold it to each person’s own access (on by default)	Every tool the agent uses follows the asker’s access rules. Ada’s assistant can only find Ada’s orders.
A person decides on refunds	The refund flow is marked This flow changes things	The run stops and waits; someone approves or declines
Outside content can’t trick it	Wait for a person after reading anything from outside (on by default)	After reading a web page, any change waits for approval
A budget	Most cost, Most steps	The run stops before it overspends
Who may use it	Who may run it: Signed-in users	Anonymous visitors can’t run it

1. Knowledge: your help articles

AI → Knowledge → Create a knowledge base: name help, model embed, Who can search it Signed-in users. Add your shipping, returns and refunds pages (paste text, or Add a web page). Try Try a search with “how long do refunds take?” and check the right passage comes back.

2. The refund flow

Build a flow request-refund with an HTTP request trigger and an input order_id:

Get record order from orders with id {{ input.order_id }}. Connect missing to Fail with status 404.
Create record in a refund_requests table: {"order_id": "{{ input.order_id }}", "status": "requested"}.
Respond with {"requested": true}.

Because the agent will run this as the asker, the Get record step follows the asker’s rules: Ada can’t request a refund for an order she can’t see.

3. The agent

AI → Agents → Make your first agent: name support, thinks with chat. What should it do?

You help customers of Northwind with their orders. Use the orders tool to look up the customer’s own orders. Answer policy questions only from the help articles, and say when you don’t know. You may request a refund with the refund tool; tell the customer a person will confirm it. Be brief and friendly. Never ask for card details.

What it can use:

Add	Settings
A table: `orders`	Find and Open only
A flow: `request-refund`	When should it use this? When a customer asks for a refund for one of their orders. Tick This flow changes things.
Knowledge: `help`

Who may run it: Signed-in users. Hold it to each person’s own access: on. Wait for a person after reading anything from outside: on. Limits: Most steps 8, Most seconds 60, Most cost ($) 0.25.

4. Try it in Studio

Try it: ask “Where is my last order?”. In Studio you’re not a customer, so test as a real one from your app (next step). Watch the steps: it calls the orders tool, then answers.

5. Use it from your app

The browser uses the person’s session, so the agent runs as them:

src/support.ts

import { pawabase } from "./pawabase";

let thread: string | undefined;

export async function ask(question: string, onText: (piece: string) => void) {
  let waitingRun: string | null = null;
  for await (const event of pawabase.ai.agents.stream("support", question, { thread })) {
    if (event.type === "text") onText(String(event.text));
    if (event.type === "waiting") waitingRun = (event.run as any).id;
    if (event.type === "done") thread = (event.run as any).thread_id;
  }
  return waitingRun;   // non-null when it asked to request a refund
}

Passing thread keeps the conversation going, so “and the one before that?” works.

6. Approve refunds

When the agent wants to use the refund flow, the run stops with status waiting. Decide who approves:

The customer themself (the person who started the run can always decide): show “Request a refund for order #1042?” with Yes / No, and call:

await pawabase.ai.agents.decide(runId, { approve: true });   // or false to decline

Your support staff instead: set the agent’s approval rule to your staff role, and start a flow on the agent.run.waiting event that notifies them. Staff approve from your admin tool with decide. In that setup, don’t offer the customer the button.

Approving continues the run from where it stopped; declining tells the agent no, and it tells the customer.

7. Check the isolation

Sign in as two customers and ask each “list my orders”. Each must see only their own. Then ask Ada’s assistant “show me order [Bob’s order id]”: the tool can’t open it, so the assistant says it can’t find it. Open AI → Agents → support → Runs to read each run: the tools it called, whether any step was refused, and the cost.

8. Watch cost and quality

AI → Usage shows tokens and cost per model.
Runs that hit a limit end as failed with the reason; if that’s common, the instructions are too vague or there are too many tools.
Read a sample of runs every week, and improve the instructions and the help articles where it struggled.

What not to do

Don’t	Because
Switch off Hold it to each person’s own access for a customer-facing agent	It would then use the agent’s own authority and could read any order
Mark the refund flow Never ask	Refunds would happen without a person
Give it Add, Change or Delete on tables “just in case”	Fewer, narrower tools are safer and give better answers
Leave Most cost empty	One long conversation could cost far more than you expect

Approvals and limits

Every safety setting.

Run from your app

The full API.

Welcome

Concepts

Quickstarts

Tutorials

An agent that respects permissions

How it works

1. Knowledge: your help articles

2. The refund flow

3. The agent

4. Try it in Studio

5. Use it from your app

6. Approve refunds

7. Check the isolation

8. Watch cost and quality

What not to do

Approvals and limits

Run from your app

​How it works

​1. Knowledge: your help articles

​2. The refund flow

​3. The agent

​4. Try it in Studio

​5. Use it from your app

​6. Approve refunds

​7. Check the isolation

​8. Watch cost and quality

​What not to do

Approvals and limits

Run from your app

How it works

1. Knowledge: your help articles

2. The refund flow

3. The agent

4. Try it in Studio

5. Use it from your app

6. Approve refunds

7. Check the isolation

8. Watch cost and quality

What not to do