Skip to main content
Some web pages offer tools to an assistant: search this catalogue, add this to the cart, file this form. Cortex reads what a page declares about itself and then asks you before any of it is used. Nothing a page offers is available to the model until you have said yes to it. This page covers where the consent card appears, what Cortex does and does not read from a page, what each of the three answers means, how narrowly Always is remembered, why a card sometimes comes back, and what happens when a call is refused.

​
Where the card appears

The same control serves two products. In Cortex Chat it appears as a card beside the execution consent in the conversation. In Cortex Bot it appears as an overlay on the bot’s computer rail. See The computer. You will see the eyebrow Page tools, the page’s own address in a monospaced line above the card, and, while something is waiting on you, a green dot with Page tools · waiting for you. The offer line names the page’s origin and how many tools it wants to offer.

​
What Cortex reads from a page

Only what is in the page’s own HTML. If a page declares its tools in code that has to run first, Cortex does not see them, and the page simply offers nothing. That is deliberate: the detection is static and fails closed rather than executing a page to find out what it wants. An annotation Cortex does not recognise is treated as a write, never as a read. A page cannot get a quieter prompt by labelling something in a way Cortex has not seen before. In Chat, Cortex fetches the page from its own side. It does not use your browser and it does not carry your cookies to that page, so a page tool never acts as your signed-in self by accident.

​
Decide on a tool

1

Read the offer

The card names the site that is asking and how many tools it has declared, with the page’s address printed above.
2

Check each row's tag

Every tool carries Read or Write. A read row says This tool can read the current page. A write row says This tool can change the current page. Review it before allowing., and it is tinted and bordered with the warning colour so it does not read like the rest.
3

Answer

Deny refuses it. Allow once permits this call and nothing more. Always is the standing grant, and it is the emphasised button.

​
What Always actually remembers

Always is much narrower than it sounds. It remembers a combination of four things: Change any one of those and the grant no longer matches. In particular, an Always for a read-only version of a tool does not carry over once that same tool starts writing: you get asked again. Allow once expires. Always does not.
Cortex does not publish a screen for reviewing or withdrawing decisions you have already made, so treat Always as a standing grant for that exact combination.

​
When a card comes back

If a site changes what it declares, the decision you made no longer describes what is being asked for, and the card returns with These tools changed. Allow them again. Read the rows again before you answer, because a tool that used to read may now write.

​
Nothing you have not granted reaches the model

Denied tools, tools still waiting on you, and everything on a guest session are simply absent from the list of tools the model can see. The model is not told about a page tool it cannot use, so it cannot try to use one and cannot tell you about one you refused.

​
Signing in

Allowing a page tool needs an account. A guest sees a single Sign in button in place of Allow once and Always, with the hint Sign in to allow page tools. You can still deny them. Deny still works for a guest. Refusing something never requires an account.

​
When you see nothing at all

Most pages are ordinary pages, and an ordinary page renders no card and no chip. The card only ever shows rows that are waiting on you or that have changed. Once every row has been decided, the whole card disappears rather than sitting there listing settled decisions. The card re-checks the page every four seconds, so a page that declares its tools a moment after it loads still reaches you.

​
When a call is refused

Arguments are checked before every call, including calls covered by an Always grant. A missing argument, one of the wrong type, one outside the range the site declared, or one the site never declared at all, is refused rather than sent. The refusal names which argument was wrong. It never repeats the value, so nothing you typed is echoed back into the conversation.

​
Limits