Agent Filesystem

Give an agent its own private filesystem so it can save notes, drafts, plans, and any other text it produces or fetches, and come back to them later. The filesystem persists across chats, so an agent can read what it wrote yesterday or what a different chat with the same agent put there last week.

Who can turn the filesystem on or off

  • The person who created the agent.
  • Anyone who has been given edit or admin access to that agent.
  • Workspace admins.

Who can see an agent's files

Anyone who can see the agent can see its files. Permission on the filesystem is not managed separately — it follows the agent. If someone has view, execute, edit, or admin access to the agent, they can also see what the agent has saved.

What the agent can do with files

When you turn the filesystem on, the agent gains a set of tools for working with text files. The agent can:

  • Create new files and save text into them.
  • Read files back, with line numbers, and page through long ones.
  • Edit files by replacing one piece of text with another.
  • Search across every file by filename or by content.
  • Rename, copy, and delete files.
  • Download text from a public web address and save it as a file.
  • Generate a temporary download link for a file so you can share it elsewhere.

What the agent cannot do with files

  • Store images, PDFs, archives, audio, video, or any other non-text file. The filesystem is text only.
  • Store a single file larger than 2 MB.
  • Store more than 100 MB of files in total. Once the agent reaches the cap, further writes are refused until it deletes something.
  • See or touch a different agent's files. Every agent has its own private space.
  • Download content from a private network address, from the app's own storage service, or from non-web protocols. The download tool blocks unsafe destinations.

What happens when you turn the filesystem off

Turning the filesystem off is a soft switch. It hides the files from the agent and removes the file tools from its toolbox, but nothing is deleted. If you turn the filesystem back on later, every file is exactly where the agent left it. Think of it as unmounting a drive, not erasing it.

If you want to hard-delete all of an agent's files, there is no one-click option in this release. Ask the agent to delete each file while the filesystem is still on, or contact your workspace administrator.

How access works

The filesystem is private to the agent by default. When you share the agent with someone else — by granting them view, execute, edit, or admin access — they get the same level of access to the files.

Practically, this means:

  • People with view or execute access can see the files and can ask the agent to read, search, and even save new files on their behalf. Any save happens as part of a chat with the agent, not as a direct action against the filesystem.
  • People with edit or admin access can also turn the filesystem on and off.
  • Nobody can reach into another agent's filesystem, regardless of workspace role, unless they have access to that specific agent.

Related guides