FAQ

Can an agent change my requirements without me?

No. Changes to the title, description, fields or images of an item written by a person are held until the supervisor approves them; then they are applied exactly as shown, as the agent’s user. Items the agents created themselves (marked aiGenerated) they change directly. Some writes are not held: comments, links, moving items into a document, and editing text paragraphs of a document. See Decisions and Security.

Can an agent approve or close its own work?

No. Agents cannot move items into approved, accepted, released, verified, done, closed, rejected or obsolete, nor run actions that need a signature. A person approves every top-level task. A delegating agent approves its teammates’ sub-tasks, which then roll up into a task a person approves.

Which models are supported?

Each agent has its own model, set as provider:model. Anthropic, OpenAI and Google are supported, through a model provider or a company LLM gateway. Claude Code agents need an Anthropic model, Codex agents an OpenAI model. See Agent runs.

Where is our data stored?

Agents, skills, connections, engagements, tasks, runs, transcripts and all artifacts are Polarion work items in your Polarion. Operational state (live events, held calls, chats, encrypted credentials) is in PocketBase next to the runner. Sandboxes run on your Docker host. See Architecture.

What does the model provider see?

Everything in the agent’s context: its instructions, the task and its comments, and the results of every tool call (work item text, documents, results from connected systems, files and command output in a sandbox). Pick the model endpoint to match your data classification. See Security.

Does it work on-premises?

The runner, PocketBase and the sandboxes run on your infrastructure. The runner needs network access to one model endpoint, plus any MCP servers and git hosts you connect. If your company runs an LLM gateway inside your network, point the runner at it.

Can I see exactly what an agent did?

Yes. Every run is an Agent Run (aiRun) work item with the model, tokens, cost, outcome, a ledger of everything it read, created, changed or was blocked from, the table of gateway calls and the full transcript. The task panel shows a run trace; AI Reports adds an audit of every AI item with CSV export. See Agent runs.

How do I stop or remove an agent?

• Pause the engagement on the Team page: the agent gets no new work in that project.
• Let it go: the engagement ends and its bot user loses its project roles.
• Retire it in the Agent Pool: it gets no work in any project.
• Disable a connection to cut off a system for all agents, or remove a standing approval to require approval again.

What does it cost, and how is it capped?

Each engagement has a budget in USD. The runner adds the cost of every run and chat turn to the engagement. No run starts when the budget is used up; built-in runs stop mid-run when they reach it, and Claude Code gets the remaining budget as its cost cap. Codex runs are checked before each run only. Costs are estimated from token usage and a price table in the runner. See Budgets.

Can agents access the internet?

Built-in agents have no web tools of their own. Sandbox agents can only read the websites listed on their engagement (and their subdomains); the list is empty by default. The internet is read-only: only GET, HEAD and OPTIONS pass. Every page read is recorded on the run. See Sandboxes.

Can agents see our credentials?

No. Bot tokens, the model key and connection credentials stay in the runner, its encrypted secret store and the sandbox credential vault. The gateway and the git proxy add credentials on the way out. Secrets can be set from the browser but never read back.

What if an MCP server changes its tools?

Agents only get the tool definitions a person reviewed. New tools are never offered until someone adds them to the policy. Tools whose description, inputs or read/write hints changed, and tools that disappeared, are held until the policy is reviewed again. See MCP gateway.

Can an agent push code to main?

No. Git goes through the gateway’s git proxy, which allows pushes only to the connection’s branch patterns (by default agent/* and feature/*) and never deletes branches. Merging is an MCP tool call under its policy, so a person decides. See MCP gateway.

Can an agent reach a repository or project we did not grant?

No. A connection must be used by the agent in the pool, active, and granted on the engagement. For scoped systems, every call must name a value from the engagement’s scope; without a scope the connection is locked until a person answers the agent’s scope question.

How do agents learn from feedback?

When you send a result back with Teach ticked, the agent proposes a project memory: a short rule. You review, edit and approve it; only approved memories reach the instructions of the agents they are for. See Memory.

What happens if an agent gets stuck?

If a run ends without submitting, asking or waiting for a sub-task, the runner nudges the agent once. If it stops again, the task is marked “Agent stopped — needs you” and set to waiting for input. Agents also cannot loop endlessly through delegation: follow-up sub-tasks and send-backs are limited. See Agent runs.

Who can approve a held change?

The supervisor decides in the task panel. The decision is posted as a Polarion comment under the decider’s name, and denials need a reason. The runner checks project access, not the supervisor role, so control who can work on tasks with Polarion permissions. See Governance.

Do we need anything special in Polarion?

The REST API with personal access tokens, one Polarion user per agent, and the Agentic app installed. The data model (types, fields, workflows, link roles) is added by the built-in Agentic setup (Administration → Setup), not by hand. See Installation, Enable a project and Data model.