Account & preferences

Set up My Hand and manage access

Set your Hand's identity and understand connector URLs, access keys and AI connection permissions.

My Hand contains the identity, connection details and autonomy settings for your selected Hand. Keep three things separate: the access key for an AI connection, secrets stored in Vault and integration permissions.

Update your Hand’s identity

Open the Hands Console and select the correct Hand.
Go to My Hand → Hand profile → Hand identity.
Select the Edit Hand identity pencil icon.
Update Name and Description, then choose Save. Use Cancel to leave them unchanged.

Both fields are required. Copy icons are also available for the name and description. The settings belong to the selected Hand, not to every Hand in your account.

Connect your Hand to an AI

Stay in My Hand → Hand profile and locate the Connector URL.
Allow Loading secure connection details… to finish.
Use the copy icon to copy your Connector URL.
Find Access key. This value is concealed; select the eye icon to reveal or hide it, or the copy icon to copy it.
Follow the Connection guide or the provider-specific instructions to configure the connection.

Treat the access key as a secret. Enter it only in the intended secure settings of your own AI provider. It is not a Vault item, nor does it authorize every connected service. The key or connection details may be unavailable while the Hand is not ready, subscription access is missing or the required connection feature is unsupported. Follow the displayed status rather than assuming a replacement key has been generated.

Set AI connection access

For a ready Hand, open My Hand → Hand profile → Autonomy → AI connection access and choose Read & write or Read-only.

Select the intended access mode.
Wait for Applying… and check the confirmed result.
On failure, the last verified access mode remains in effect. Do not assume the new selection succeeded.

This setting affects what an AI connection may do through the Hand with files, commands and connected services. It does not automatically change OAuth grants at Google or other providers. Permissions for individual integrations are managed separately. Where available, Maximum freedom requires Review changes followed by an explicit Apply action.

Review Maximum freedom before applying it

Maximum freedom broadens supported action rules only within access that already exists. It neither connects a new service nor asks Google or another provider for extra access.

Go to My Hand → Hand profile → Autonomy → Maximum freedom.
Apply or discard any unsaved Plug-in or MCP permission edits first. Review changes remains unavailable while those edits are pending.
Choose Review changes and inspect every proposed change and every skipped item.
Choose Apply only if the complete list is appropriate. Choose Cancel to leave the current rules unchanged.
Read the final result. If only part of the plan was applied, review the newly rebuilt plan before deciding whether to continue.

For supported Plugins, the plan chooses the most permissive action mode that both the existing provider permission and the selected Hand already support. A read action may become allowed; a changing action may become automatic or stay at a less permissive available mode. For a connected read-and-write MCP connection, eligible writable tools are proposed as Automatic. Read tools are not changed.

An item can be skipped because provider access was never granted, its access cannot be widened safely, the integration or selected Hand is unavailable, another connection controls the shared action, or an MCP connection is not ready or is read-only. The dialog can summarize some of these as not safely available for broadening. A plan with No changes has nothing to apply.

The Console applies one connection after another. If a later connection fails, earlier confirmed changes remain in effect. The Console reports the partial result, refreshes the permissions and rebuilds the plan; it does not silently roll earlier changes back.

If connection settings are unavailable

Check that you own the selected Hand and that its status is ready. A Hand still being provisioned or an account without the required subscription access may have connection controls disabled. Avoid revealing the access key during screen sharing or on a shared computer.

For stored API keys and other credentials, use Vault, not the Access key field. For per-service permissions, see Control what your Hand may do and Approve or automate MCP tool actions.