When an agent joins a canvas, the first question is not what it can draw. It's what it is allowed to touch.
One rule
On Floo, an agent acts as the person who connected it — with exactly their permissions, no more. If you can open a canvas, your agent can open it. If you can only comment on a canvas someone shared with you, your agent can only read it. There is no separate "agent role" to forget about.
Sign-ins you can reason about
An agent signs in once with OAuth: the first time it connects, a browser tab opens and you approve it as yourself. Headless agents — n8n flows, CI jobs, scripts — use an agent key instead, named after where it runs ("deploy previews"). Keys are stored as hashes and shown once, and revoking one stops that agent at once without touching the others.
Model keys stay yours
The built-in Floo Agent runs on a model key you add in Settings. It's kept in an encrypted vault and never shown again — Floo only displays its last four characters. Usage is billed by your provider, on your account.
Work that arrives from elsewhere
Linear issues delegated to Floo and Slack mentions become private canvases in the installer's personal space, running on the installer's key. Nothing lands in a team space unless a person moves it there.
The result is a canvas you can share without wondering what a bot might do with it: the agent can do what you can do, and nothing else.