Skip to main content

Planhat OS - Pi tool permissions

"Pi tool" settings/permissions determine what types of actions Pi can carry out on behalf of a User. You can disable specific Pi tools for Roles or your whole tenant

Written by Natalie Kwong

Summary

  • "Pi tools" are a set of permissions that limit what Pi (the main Planhat OS AI Agent) can do, such as "Create records", "Update records" or "Create automations"

  • The default is that all available Pi tools are enabled, but you (as a Planhat Admin) can disable any you choose

  • You can configure Pi tools on two levels: in User Roles, and for your whole Planhat tenant (in Pi Data Access)

  • Having Pi tools disabled limits what an individual User can do with Pi, but having Pi tools enabled can't add additional access compared to that User's Role (as set in their Role data model permissions etc.)

  • Even with some Pi tools switched off, Pi will still be able to help your Users with other things

  • Preventing Pi from carrying out an action doesn't prevent a User from carrying out that action manually themselves, if their other Role permissions allow it

Who is this article for?

  • Planhat OS Users who are Admins

Related articles

Other articles particularly relevant to this article are:

Article contents

Introduction

Pi - Planhat's main AI Agent - acts on behalf of the Planhat User chatting with it. For example, it might look up some Planhat data, and display it in a table or graph. Out of the box, Pi can do anything that the User's Role (see definitions box below) allows. That's usually what you want from Pi, but not always.

For example, you might be happy for Customer Success Managers (CSMs) to ask Pi to update fields and build dashboards, but keep Automation changes only possible for your Ops team to make manually.

"Pi tools" let you limit what Pi can do - a limit that applies on top of any other permissions (i.e. it can restrict access but not give additional access). Each "Pi tool" corresponds to a type of action Pi can carry out, such as "Create records". You can switch off the Pi tools a Role (e.g. CSM) shouldn't use, and Pi will stop offering them to anyone with that Role - while it keeps helping with everything else. You can even switch off a Pi tool for everyone in your Planhat tenant (including you) if desired, via Pi Data Access.

📌 Important to note - disambiguation

"Pi tools" - as discussed in this article - should not be confused with the main "Tools" menu in Planhat OS, which is where you can open Signals, Data Explorer, Calendar, the main Settings Tool, and many other parts of Planhat.

In addition to this, MCP Plugins add tools from external applications, such as searching Slack or reading a Google Doc - so that's also something separate from the Pi tool permissions/settings discussed in this article.

📌 Definitions

  • "Pi" - the advanced AI Agent built into Planhat OS

  • "Sessions" - where you can chat with Pi and/or colleagues in Planhat OS

  • "Data models" (also called simply "models") - how data is organized in Planhat, similar to the "objects" you may be familiar with from other software. For example, "Company" is the model for organizations that are your customers/prospects, and "End User" is the model for people working at those Companies (i.e. your contacts)

  • "Records" - individual pieces of data within those models. For example, a Company record could be "Apple", and an End User record could be "David Attenborough"

  • "User" - the Planhat data model for users of Planhat, i.e. you and your colleagues

  • "Role" - the Planhat version of "profiles" or "permission sets" you might be familiar with from other software. You (as a Planhat Admin) configure Roles for different groups of Users, e.g. Administrator, Sales, Developer, etc.

  • "Pi Data Access" - where you can configure Pi permissions/limits that apply to your whole Planhat tenant

  • "Your tenant" - your organization's copy of Planhat; your organization's Planhat environment

What are Pi tools?

There are lots of different Pi tools. Each individual "Pi tool" corresponds to the ability of Pi (the built-in AI Agent in Planhat OS) to carry out a specific type of action on your behalf, such as creating a record or building an Automation.

Each Pi tool is enabled by default (if it's available in your Planhat tenant), but you (as a Planhat Admin) can turn your choice of Pi tools off if desired.

"Pi tools" is a new category of permissions introduced in Planhat OS, adding to the existing data model permissions, workflow permissions and portfolio permissions.

The example screenshot above shows this within a Role, which you can use to set access for a group of Users; in addition to this, you can configure Pi tools in "Pi Data Access" on a whole-tenant level.

📌 Important to note - combining permissions

Each level of permissions applies a limit to access.

Pi can only use a Pi tool when it's enabled both for the tenant (in Pi Data Access) and in the Role of the User using Pi. For example, if the Pi tool "Creates records" is enabled for your tenant, but then disabled for the CSM Role, then someone with the CSM Role in your tenant would not be able to use Pi to create records.

Having a Pi tool enabled never gives Pi more access than the User's Role already has. For example, if a Role only has data model permissions for the Company model but not the End User model, and it has the Pi tool "Create records" enabled, then Users with that Role will be able to use Pi to create Company records but not create End User records.

Turning off a Pi tool only removes the relevant ability from Pi. Users can still carry out the action (e.g. creating a record) manually, if their Role allows it.

📌 Important to note - Super Admin permissions

In addition to these places where you (as a Planhat User who's an Admin) can configure Pi tools, be aware that there are also "Tenant Permissions", including Pi tools, which only Planhat staff ("Super Admins") have access to. Similarly, some Pi tools need to be enabled in a tenant via a feature flag by Planhat staff (at the time of writing). If you can't see a particular Pi tool that you're looking for, reach out to your Planhat contact.

Each Pi tool is a toggle switch: it can either be on or off. By default, Pi tools are on (available/enabled), but you (as a Planhat Admin) can disable your choice of Pi tools, to limit what Pi is able to do.

As shown in the screenshot above, for each Pi tool, you can see its name, a one-line description, and a colored "badge" (where applicable) to highlight when the Pi tool:

  • "Writes data" - creates or changes something in Planhat

  • "Sends data outside Planhat" - sends information to a service outside Planhat, such as a web search - note that this functionality is not generally released at the time of writing

The Pi tools are grouped into four categories:

  • "Actions" - make changes in Planhat and message colleagues (other Users in your tenant)

  • "Agents" - build Automations and inspect how they ran

  • "Pages" - create and edit standard Pages (e.g. Dashboards, Documents and Data Tables) and Artifacts (a new special Page type for Planhat OS)

  • "Power" - capabilities that go beyond your Planhat data, such as searching the web - note that this functionality is not generally released at the time of writing

Pi tools in more detail

📌 Important to note

The list below is not necessarily exhaustive, as more Pi tools are being added to Planhat OS over time.

Also note that the access to some Pi tools may be controlled via tenant-level feature flags that can be enabled by Planhat staff only.

Actions

  • "Create records" - Pi can create new records, such as Companies, Tasks or Licenses

  • "Update records" - Pi can change fields on existing records

  • "Message colleagues" - Pi can send messages to colleagues (other Users within your Planhat tenant, in Sessions) on behalf of the User using Pi

  • "Manage chats" - Pi can rename Sessions, add colleagues (other Users in the tenant) to them, and change who can find them

Agents

  • "Create automations" - Pi can build new Automations from a plain-language description

  • "Edit automations" - Pi can change existing Automations from a plain-language description

  • "View automation runs" - Pi can list the recent runs of an Automation and whether each one succeeded

  • "Read automation run logs" - Pi can read the step-by-step log of an Automation run to explain what happened

Pages

  • "Create pages" - Pi can create Pages, such as Data Tables, Boards, Documents and Dashboards

  • "Edit pages" - Pi can rename Pages, change their filters and columns, and edit Document Pages

  • "Create artifacts" - Pi can build Artifact Pages, a new Page type for Planhat OS, which include dashboards, charts and tables that show live data

  • "Edit artifacts" - Pi can change existing Artifact Pages, a new Page type for Planhat OS, including dashboards, charts and tables

Power

  • "Search the web" - Pi can search the public web for current information, company news and external sources - note that this functionality is not generally released at the time of writing

📌 Important to note

Some of what Pi does is always on, and has no switch to enable/disable: reading and searching records, searching your Knowledge Base (formerly called Content Explorer - your tenant's Pages, Views and Sections) and the Planhat Help Center (support articles like this one!), reading Pages and attachments (files), and using Memory and Skills. Pi always reads data as allowed in the User's Role permissions and Pi Data Access.

Why configure Pi tools (e.g. disable your choice of individual Pi tool)?

As we previously mentioned, Pi tools that are available in your tenant (e.g. they are generally released Pi tools) are available for all your Users as default, but as a Planhat Admin you can turn off your choice of Pi tools, either on a per-Role basis (for specific groups of Users) or on a whole-tenant basis. You can also turn them back on at a later date if desired.

So why might you want to turn Pi tools off (and potentially back on)? Example use cases are:

  • Roll Pi out in stages: start a team on read-only access, and switch on "Writes data" Pi tools later

  • For actions that you want to be manually reviewed by a person (such as creating/editing Automations), prevent Pi from carrying out that action automatically

  • Keep data inside Planhat until your security team approves Pi tools that send data outside it. (Note that Pi tools that send data outside Planhat are not generally available at time of writing)

How to switch off (or on) a Pi tool for a Role

Firstly, let's go through how to disable (and re-enable) Pi tools for Roles. This is how to configure a Pi tool for a specific group of Users - for example, because you would like Administrators and Managers to be able to use Pi for a particular action, but you don't want CSMs or Salespeople to use Pi for it.

  1. Go to the "Users & Roles" Tool by clicking on "More" in your Planhat OS sidebar, and clicking "Users & Roles" (in the "System Configuration" category at the bottom)

    Click the image to view it enlarged

    • You can also access this from within the "Settings" Tool in Planhat OS, by clicking on "Users & Roles" at the top

  2. Click on "Roles" to expand out the Roles list, and click on the Role you want to change

  3. Click into the "Pi tools" tab

  4. Find the Pi tool you want to disable, and use the toggle switch to switch it off. (Or, if it's currently switched off and you want to turn it back on, click on the toggle switch to enable it)

The change applies from the next message any User with that Role sends to Pi.

How to switch off (or on) a Pi tool for everyone in your tenant

We've just gone though disabling (or enabling) Pi tools for an individual Role, corresponding to a specific group of Users. But sometimes you might want to disable a Pi tool for all the Users in your Planhat tenant, because you don't want Pi to carry out that action for anyone (even Administrators). Rather than needing to modify this in every individual Role, you can do this on a whole tenant level via "Pi Data Access".

📚 Further reading

We have a separate article on Pi Data Access more generally, which you can read here.

To disable (or enable) Pi tools for everyone in your Planhat tenant (i.e. you and your colleagues):

  1. Navigate to "Pi Data Access". There are two alternative ways to do this:

    • Either go to the "Agents" Tool, mouse over "Governance", click "More", and then click on "Configure" next to "Pi Data Access"

    • Or go to the "Settings" Tool, click "Security", click on "Pi Data Access", and then click on "Configure"

    • Remember that you can access these Tools via the main Tools menu, by clicking on "More" in your sidebar; and that you can also pin your choice of these Tools to your sidebar

  2. Scroll down to the Pi tools area (underneath the data model permissions)

  3. Click on the toggle switch for your chosen Pi tool to disable (or enable) it

📌 Important to note

  • A Pi tool that's off in "Pi Data Access" is disabled for every Role, regardless of whether it's enabled in any Roles. A Pi tool needs to be on in both "Pi Data Access" (the tenant level) and in the User's Role for that User to be able to use it

  • Pi tools do not apply to (are not available for) External Roles for External Users (your customers/prospects in Portals) at the time of writing

Frequently asked questions (FAQs)

  • Q: Why can Pi carry out a particular action for my colleague but not for me?

    • A: Your Role may have that Pi tool switched off. An Admin (User who's an Admin in your tenant) should check the "Pi tools" tab in your Role

  • Q: Are Pi tools on or off by default?

    • A: On. Every applicable* Pi tool is on for every Role until an Admin switches it off. (*Some Pi tools may not have been enabled by Planhat staff for your tenant, e.g. if they are controlled via a feature flag. If so, they won't be visible in your tenant)

  • Q: If I switch off the "Update records" Pi tool, can my Users still update records themselves (i.e. without using Pi)?

    • A: Yes. The switch only stops Pi. Users can still update records by hand if their Role allows it

  • Q: How do I switch a Pi tool off for everyone, including Admins?

  • Q: Can I switch off Pi tools for one specific User?

    • A: Not at this time (unless they are the only User with a particular Role in your tenant). Pi tools are set per Role

  • Q: What happens if I ask Pi to do something where the applicable Pi tool has been disabled for me?

    • A: When a Pi tool is off, Pi can't call (use) it. Pi will explain in words that it can't do that. There won't be an error message

Did this answer your question?