How agents stay safe and what is kept
The safety rules built into every agent, what the run record contains, and how PGB monitors AI use for abuse.
Agents act on your behalf, so safety is built in rather than optional. The Settings page lists the main promises under Safety.
The safety rules
- Sending, sharing, spending and installing always wait for your approval. The agent cannot skip this step.
- Each run has a budget and a step limit, and you can cancel it at any time.
- Every step is recorded on the run page.
- Tools are opt-in. An agent only gets the tools you tick.
- Read-only by default. The database tool can only read, and returns at most 100 rows.
- Outside access is guarded. The web tool refuses private and internal addresses.
- Your own agents only. Another person's agents, runs and approvals are invisible to you and yours to them.
Keep secrets out
Do not put passwords or keys in instructions or inputs. Use the AI keys page for AI keys and the PGB Business access section for a mailbox key. A secret in an instruction is visible on the agent page.
Webhooks
A webhook address contains a secret. Treat it like a password and use Rotate secret if it leaks. The body you send becomes the run input and is labelled as untrusted data to the agent.
How we monitor AI use
How we monitor AI use. To keep PGB safe from abuse such as phishing, malware and spam, we keep a copy of what you type into AI features in PGB Studio, PGB Agents and PGB Learn (your requests and your agents' instructions and inputs, not your files, mail, calendar or other data the assistant reads to answer you). Passwords, keys and similar secrets are masked before it is saved, and only a short preview of the assistant's reply is kept. We keep this for 30 days, then delete it. Only a small group of PGB operators can see it, every look is recorded, and it is used only to investigate abuse and protect the service, never for advertising or to train models. Organisations with their own agreement may be excluded.
For Agents this means: an agent's instructions when you create or change it, and the input for each run, including a schedule's text or a webhook payload.
Account Settings
The Settings page shows the PGBHub account you are signed in as. Manage PGBHub account opens your PGBHub account page for passwords and sessions. Sign out ends your session here.
Good to know
- Deleting an agent removes its runs and memory.
- Use Forget on the agent page to remove a remembered note.
- If you suspect misuse of a webhook or key, rotate or remove it first, then pause the agent.
More guides in PGB Agents
What a PGB Agent is and what it can do
An agent is a saved job with instructions, a list of allowed tools, a budget and a record of every step it takes.
Create an agent from scratch or from the Marketplace
Make a blank agent in two clicks, or add a ready-made one from PGB Marketplace and review it before it runs.
Write good instructions for an agent
How to word the Instructions box so an agent does the right job, stays inside its limits and tells you when it is unsure.
Choose tools and understand which need approval
The list of tools an agent can use, what each does, and which ones always pause for your approval.
Start agents manually, on a schedule or from a webhook
Run an agent by hand, set it to repeat with the schedule builder, or give it a private web address that starts a run.
Set budgets and know when a run will stop
Put a dollar limit on each run and each month, and learn the other limits that stop an agent from running away.