What an agent can and cannot do in your account

A connected agent acts as you, on your own workspace. It reads and writes your lists and the items on them, reaches the items and lists others shared with you with the rights you have there, reads your automations and starts one, and brings things back from the trash. It does not reach your connected apps or your email, cannot write what Roma remembers about you, and cannot create or change an automation. Everything it changes shows in your Event Log as your own action, marked as coming through that agent.

What an agent can see

An agent starts a conversation with one look at your workspace: who you are and today's date in your timezone, what you asked Roma to remember, your lists with their properties, what is overdue, due today, in progress or due in the next seven days, the newest tasks on your Tasks list, recent notes, your automations with their last run, and three days of activity. From there it searches by meaning or keyword, reads an item in full, its body, status, due date and properties, and reads the chat on the item.

What an agent can do

The tools an agent gets fall into a few groups, the same for every agent:

• Lists. Keep any list, your tasks, your notes, a reading list, a CRM, each with the properties you gave it. Create one, reshape it, delete it. Your Tasks list cannot be deleted.

• Items. Add, update, move and delete what is on a list, many at once: a task with its due date, a note, a book on a reading list, each with a body to work in. Up to 100 items go in with one call.

• Search. Find anything you keep.

• Chats. Read the chat on an item, and leave a note there under its own name, so you see it on every device.

• Trash. Nothing is lost on delete. The trash keeps it for about 30 days, and the agent can put it back.

• Automations. Read your automations and what their runs found, and start one when you ask.

• Triggers. Be woken when something changes, instead of checking on a clock. Triggers: wake your agent when something changes.

The developer docs at /developers/tools list every tool with what it takes and returns, word for word what the agent reads.

How an agent works on a task

Every agent is given the same house rules on connect. An item's body is where its work lives, as the current state of the thing, not a diary of attempts. The agent may change any of it, its own text and yours, the way a collaborator would, and continues what is already there rather than adding a second copy. Subtasks are a checklist in the body, ticked as the work moves. It sets a task to In progress when work actually starts, and leaves Completed to you.

The chat on a task is its log of what happened outside Roma and of what needs you: an action taken, with its link, or the one question the work is blocked on. The agent's post shows there under its own name, with "via MCP" after it, and reaches you on every device. The conversation on a task or note explains that chat.

Every change to a body is kept in version history under the editor's name, so an edit you did not want can be undone: Version history and undo.

What it asks before doing

Every tool tells the agent whether it reads, adds, or updates and removes. An agent runs the tools that only read without asking, or asks once and remembers, and asks before the rest: Claude asks the first time a tool runs and offers Allow always, ChatGPT confirms and can remember your choice for the conversation, and you can allow more in the agent's own settings. Three things always ask. Starting an automation, because a run can act through your connected apps. Replacing a whole body in one go, which needs an explicit confirmation from the agent. And a move that would drop values an item holds, which answers a preview first and moves nothing until the loss is acknowledged.

Roma's own Permissions page governs the operator, not outside agents. What an agent may do without asking is decided in the agent.

What it cannot reach

• Your connected apps. Gmail, Google Calendar and the rest stay inside Roma. An agent uses its own connections for mail and calendars, and only what it sends to Roma arrives there.

• Your email through Roma, for the same reason.

• Memory, to write. An agent reads what you asked Roma to remember, so an outside chat can be consistent with the one inside Roma. Adding to it or changing it stays in Roma.

• Automations, to create or change. The agent reads them and starts one. Setting one up stays in Roma, where an approval card shows you the schedule and the steps.

• Roma's own instructions to its model, and your experts.

• Anyone else's workspace. An id that belongs to another person answers "not found".

Deletes are soft

Every delete an agent makes goes to the trash, the same trash as yours, and stays recoverable for about 30 days. The agent can list the trash and restore one item or list per call. Restoring a list brings back the items deleted with it. Deleted tasks, notes and lists covers the trash from your side.

On items shared with you

An item someone shared with you shows up to the agent marked as shared, with the rights you have on it. An item shared with you on its own opens its title and body: its status, due date, properties and images stay the owner's, and when the agent tries to change one of those, Roma refuses it by name and writes nothing. An item on a list shared with you opens everything but the owner's favorite. Moving or deleting a shared item stays the owner's. A change you make through an agent lands under the owner with you named as the one who made it. Agents and automations on shared items has the whole picture.

It is all recorded

A change made through an agent is your own action: it shows in your Event Log like a tap in the app, marked as made through that connection, with the agent named. The Event Log and reverting a change is where to look when something moved and you want to know who did it.

Questions people ask

Can an agent send email or post somewhere for me through Roma?

No. Roma's connected apps are not reachable from an agent, and the only tool that reaches outside Roma on your behalf is starting an automation, which every agent asks about first. Mail an agent sends, it sends with its own connections, not Roma's.

Can an agent mark my tasks done?

An agent can set a task's status, and the rules it is given say to set In progress when work starts and to leave Completed to you, since you decide when something is done. If one completes a task anyway, the Event Log shows it and the status can be set back.

Could an agent delete everything?

It could delete items and lists, except your Tasks list, which refuses. Every delete is soft and sits in the trash for about 30 days, from where you or the agent restore it. An agent asks before a delete unless you allowed it always in the agent's settings.

Does an agent see what Roma remembers about me?

Yes, read-only. The facts you asked Roma to remember are part of the one look an agent takes at the start, so it can be consistent with the operator. It cannot add to them or change them.

How do I limit what an agent may do?

In the agent: each agent decides what it runs without asking from the tool's own label, and its settings let you require approval per tool, or block one. To stop an agent entirely, remove Roma in the agent, or revoke its API key under Settings, then Connections.