Is it safe to connect an AI agent?

Connecting an AI assistant to your design account is a reasonable thing to be careful about. This page answers the questions people actually ask, in plain terms. The short version: a connected agent acts as you, inside your workspace, using a small set of design tools, and every change it makes is reversible.

For the mechanics of credentials, see Tokens & security.

What can it reach?#

Your workspace, with exactly your permissions, and nothing else.

Every call runs against one workspace: your personal one by default, or a team workspace you are an active member of. Pointing an agent at a workspace you do not belong to is refused outright. Inside a workspace, each design is checked individually against the same rules the app uses, so an agent cannot open a design you would not be allowed to open.

It cannot see other users' designs, other workspaces, or anything under the hood of the platform.

Can it delete my designs?#

No. There is no delete tool on the connection at all.

The strongest things an agent can do are replace a design's contents, or remove an element or a page inside a design. It cannot remove the last remaining page, and it cannot remove the design itself. Deleting designs stays a manual action in the app.

Can it wreck work I already did?#

Every agent write snapshots the previous state first. You will find it in the design's version history labelled Before agent update, and you can restore it in one click.

Agent edits are also tagged as coming from an agent, so when you look back at a design's history you can tell your own saves apart from anything an assistant did.

What if someone is editing that design right now?#

A design with a live collaboration session open refuses agent writes. The agent has to explicitly ask to work on a copy instead, which creates a new design and leaves the one people are editing untouched.

Can I give it look-but-do-not-touch access?#

Yes, and it is the right default for anything running unattended.

When you mint an agent token you choose Read only or Read & write. A read-only credential does not merely get refused when it tries to write: the writing tools are not offered to it in the first place, and each one re-checks the credential before doing anything.

Read-only is ideal for an agent that summarizes what is in a workspace, checks designs against brand rules, or pulls content for a report.

Can it spend money, change my plan, or see my billing?#

No. There are no billing, account or administration tools on the connection. An agent can create, read and edit designs, and browse the template gallery. That is the whole surface.

Agent usage also consumes no Popcorn AI credits. The connected assistant brings its own model; Popcorn only validates and compiles the documents it sends.

Can it flood my account?#

Requests are capped at 60 per minute, documents it sends are capped in size, and your plan's design limits still apply. A runaway agent hits a wall quickly instead of filling your workspace.

How do I cut it off?#

• Agent token: delete it under Settings → Your agent access. It stops working immediately. Each token shows when it was last used, so you can spot one you have forgotten about.
• OAuth connector: remove the connector in the AI app. Access lapses within a day, at the next token refresh.
• Everything at once: if your organization needs it, an administrator can switch external agent access off account-wide, which stops every token and every connector at the same time.

The one thing to be careful with#

Treat an agent token like a password for your account, because that is what it is. It is shown once, it is not recoverable, and anyone holding it can act as you.

Sensible habits:

• Use Read only whenever the agent does not need to create or change designs.
• Set an expiry when you mint it. Tokens have no expiry unless you choose one, and 30, 90 or 365 days are all available.
• Mint a separate token per tool, so you can revoke one without breaking the others.
• Never paste a token into a shared document, a repository, or a chat you do not control.

OAuth connections avoid this entirely: there is no token for you to hold, the connection is approved in your browser, and it expires and refreshes on its own.

Next steps#

• Tokens & security for scopes, expiry and limits.
• Where you can connect to pick the right method for your app.
• Tools reference for the exact list of what an agent can call.