# What the model can and cannot do > Two models take part in acquiring a tool. What Graft's model is given and refused, what the agent's model can call, and what only you can do. Source: https://docs.getgraft.ai/graft/security/what-the-model-can-and-cannot-do Two models take part when an agent acquires a tool, and it helps to keep them apart. **The agent's model** is the one driving your harness; it decides what is needed and calls Graft's meta-tools. **Graft's model** is the coding model inside Graft's service that writes the tool when `acquire` is called. Intent and consent stay with you and your agent; the pen is Graft's. Neither model ever holds a credential. ## Graft's model `acquire` hands Graft's model a goal, any hints, the thin authoring skill, and a brief of the connection: its id, vendor, display name, scheme, primary host and declared hosts. Never a credential, never a capability token. From there it can: - **Read documentation.** Public https pages, fetched from Graft's server rather than a sandbox, as plain text. A cheaper triage model decides which URLs from the goal and hints to read and condenses long pages; it never writes code. - **Write a module** into a draft on the agent's sandbox, and read the check's refusals and advice back, each with a file, a line and a hint. - **Prove it with reads.** Once you have approved the build for that agent and connection, it may make a handful of `GET` calls against the connection through the proxy, under a dry-run token, to learn the vendor's real shapes. - **Publish and dry-run.** The published version is run with a test input under the dry-run claim: reads reach the vendor, every other method stops at the proxy with a preview. A failing dry run is diagnosed and a changed module tried, up to four attempts within a token ceiling, and then the job gives up and says why. - **Promote** the passing tool into the agent's working set. It cannot: - **See or enter a credential.** It is never given one, and the console is the only place one is typed. - **Make a real write.** Every non-read it attempts during authoring stops at the proxy. The first real write happens later, when your agent invokes the published tool and you have answered its ask. - **Reach a host outside the connection.** The proxy pins every request to the connection's declared hosts and refuses the rest, private ranges included. - **Install a package the policy refuses**, or skip the check. Both run in Graft's service, on the server, not in anything the model controls. - **Set its own annotations.** A tool's read-only and destructive hints are derived by the check from the HTTP methods the module uses, never from anything the model says about it. - **Delete anything.** Nothing in the toolbox is ever deleted by the system. - **Edit your harness.** Your agent's own skills and instructions are never a surface Graft touches. A documentation page is untrusted text. The authoring tools carry no credential and no token, so the worst a prompt injection on a page can do is write a file the agent then declines to publish, and a module that tries to send anything anywhere finds no credential to send and no host it can reach. ## The agent's model Your agent sees Graft's meta-tools and exactly the tools promoted for it. It can call `find_tool`, `promote`, `demote`, `run_tool`, `acquire`, `acquire_status`, `request_connection` and `request_credential`; call any promoted tool first-class; and, through the advanced authoring tools and each connection's `execute__` tool, run code in its own sandbox against a connection in its scope, once you have approved the build for that connection. In that sandbox nothing holds a credential; a run carries a per-exec token for one connection, for minutes. It cannot see a secret, since none ever passes through it and the handoffs it relays carry none. It cannot reach a vendor outside a connection in its scope: the token minted for its run names the scope, the proxy refuses the rest, and a tool bound to a connection the agent was never given is refused before any token exists. It cannot get past an approval: reads pass, any other tool asks once and the answer holds, a tool you set to ask every time asks before each call, and the rule is enforced on the server and not by anything the agent's model believes. It cannot write during a dry run, whatever the code does, because the proxy is what reads the claim. And it cannot reach another person's connections or toolbox. ## You You enter every secret, in the console. You approve a build once per agent per connection, at the moment Graft's model would start reading your data. You approve a write or a destructive tool once per agent per tool, and the ask tells you which it is; you can set any tool to ask you before every call instead, and set it back. You can revoke a connection, an agent's token or a standing approval at any time, and re-enter a rotated credential without touching any approval. The description you are shown when a tool asks is marked as the model's words; the source is one `read_tool_source` away when a write matters. ## Prompts to try ```text Acquire a tool that lists my Unleashed sales orders from the last week. Read-only is enough. ``` ```text Before you build anything against Xero, tell me which hosts the connection can reach. ``` ```text What did the dry run of the new tool try to send, and why did it stop at the proxy? ``` ## Where next - [Acquire](https://docs.getgraft.ai/graft/concepts/acquire.md): The job, step by step, from goal to promoted tool. - [How credentials are protected](https://docs.getgraft.ai/graft/security/how-credentials-are-protected.md): The path a request takes and what refuses at each step.