Skip to main content

​
Tool Palette Security

Every automation can restrict its ADE tool surface with a tool palette. This is the primary safety mechanism for unattended execution.
PaletteCapabilitiesWhen to Use
read-onlyRead files, read git history, read context packsReview, summarization, analysis
write-filesread-only + write and create filesCode/document edits, lightweight maintenance
full-gitwrite-files + all git operationsCommit/branch automation, PR prep
full-adeAll ADE tools including mission/Linear/gh actionsComplex orchestration automation
CustomExplicitly listed toolsPrecise scope for a specific workflow
Avoid granting full-ade permissions unless the workflow needs end-to-end orchestration. Start with the narrowest palette that can complete the task.

​
Memory Modes

Control how much context an automation carries between runs.
Each execution starts fresh with no history carried forward. This is the default and safest for infrequent, security-sensitive automations.
memory: stateless

​
Built-in budget controls

Automation budgets are enforced from shared settings in Settings > Usage and apply across:
  • Background automations
  • Missions
  • Chat and terminal automation helpers
  • Linear and GitHub maintenance jobs
Budget controls include:
  • Per-rule budget cap for token or USD spend
  • Global budget cap for project-wide usage policy
  • Daily / weekly policy tied to the user-selected spending model
When caps are reached, ADE stops new queueing and marks runs as budget-gated. You can resume by increasing the shared budget or re-running the rule manually when limits reset.

​
Verification controls

Automations can run at different confidence levels:
  • Automatic: proceed when clear output is produced.
  • Manual verify: pause before side-effect actions such as committing, opening PRs, changing branch state, or sending external updates.
Verification settings should be configured per automation and are visible in the rule’s run options.

​
Troubleshooting

  1. Confirm the automation is enabled in the Automations list.
  2. Verify the trigger definition and trigger filters.
  3. Check the Run History in Automations for errors in trigger evaluation.
  4. Confirm required connectors are healthy in Settings (webhook secret, GitHub auth, etc.).
  5. Review the trigger event shape if using webhook or github.webhook.
The rule hit a shared budget limit and stopped execution.
  1. Open Automations → History and find the blocked run.
  2. Review how much budget was consumed.
  3. Adjust shared budget policy under Settings > Usage, or move this automation to a smaller-scope execution surface.
  4. Re-run if the work is still needed.
The execution attempted a file change outside its configured tool scope. This is working as designed.
  • Expand the tool palette to include the specific operation.
  • Or switch to a workflow that writes in a narrower directory.
For action-based triggers or outputs that call Linear:
  1. Ensure the project connector is healthy in Settings.
  2. Confirm the workflow only requests actions within allowed scopes.
  3. Run with a tighter action palette before broadening to full Linear access.
Screenshot: Automation run history showing a run that was paused for manual verification before an external write action.