{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Agent host blog",
 "home_page_url": "https://agenthost.geenius.io/blog/",
 "feed_url": "https://agenthost.geenius.io/blog/feed.json",
 "description": "Practical posts on defining agents without code, the risk rule, approvals, schedules and digests, and your own model key, from the team building Agent host.",
 "language": "en",
 "items": [
  {
   "id": "https://agenthost.geenius.io/blog/an-agent-is-a-definition/",
   "url": "https://agenthost.geenius.io/blog/an-agent-is-a-definition/",
   "title": "An agent is a definition, not a program",
   "summary": "Why Agent host defines an agent as data: description, instructions, skills, knowledge and tools, saved as versions you can roll back.",
   "date_published": "2026-10-18T09:00:00Z",
   "authors": [
    {
     "name": "The Agent host team"
    }
   ],
   "tags": [
    "agents",
    "basics"
   ],
   "content_text": "When people hear agent, they picture code. In Agent host an agent is something plainer: a definition. It says what the agent is for, how it speaks, what it knows and what it may use.\nWhat is in it\nA description in a line. Standing instructions, which become its system prompt. A persona for its voice. Skills, which are named instructions such as how to summarise or how to label. Knowledge, which is named text it can rely on, such as opening hours. A model tier. The connectors and tools it may use. A schedule, if any. And limits on how many steps and tool calls one turn may take.\nWhy data\nData can be validated. When you save a definition, it is checked, including whether the schedule you asked for is allowed on your plan. Data can be versioned: every save is an immutable version, so you can see what the agent was told last Tuesday and go back to it. Data can be shared: a definition can be authored in Prompt Verse and linked. And data cannot do anything on its own. There is no code in an agent that could surprise you, because there is no code.\nThe fixed part\nWhatever you write, the runtime adds fixed rules to the prompt. Text that comes from tools, web pages and messages is data, never instructions. Risky actions wait for the owner. An agent cannot argue its way around the second rule, because the rule is not in the prompt only: it is in the gate.\nStart from a template\nThe built-in templates show what a good definition looks like. The inbox triage agent sorts what you forward and drafts replies, and the instructions say plainly that it never sends. The research digest agent wakes on a schedule and writes a digest. The Geenius OS project agent reads your projects and reports.\nKeep it short\nInstructions that fit on a screen get followed better than a page of rules. Put the facts the agent needs into knowledge, and the way you want it to behave into the persona. Then try it in the chat, change one thing and save a version.\nWhat it does not do\nIt does not run your code, and it is not a general automation tool. If a job needs something the tools do not offer, the agent cannot do it.\nSee define an agent."
  },
  {
   "id": "https://agenthost.geenius.io/blog/what-counts-as-risky/",
   "url": "https://agenthost.geenius.io/blog/what-counts-as-risky/",
   "title": "What counts as risky, and who decides",
   "summary": "The one rule Agent host uses to decide which tool calls an agent may make alone and which wait for a person, and how to mark tools safe.",
   "date_published": "2026-10-18T09:00:00Z",
   "authors": [
    {
     "name": "The Agent host team"
    }
   ],
   "tags": [
    "approvals",
    "safety"
   ],
   "content_text": "An agent that can do things needs a rule about which things. In Agent host the rule is one function, and the approval gate reads nothing else.\nThe rule\nWeb fetch and web search are safe when you turn them on: they read, and what they return is treated as data. The outbound webhook is risky, always: it sends something out. A tool of a connector is risky unless you listed it as read-only. And anything the rule does not know is risky.\nWhy this way round\nYou could list the dangerous tools and allow the rest. That fails the day a connector adds a tool. So the default is the other way: every connector tool asks first, and you opt in to the ones that only read. Adding a tool to a connector never makes an agent more powerful behind your back.\nMarking tools\nWhen you add a connector, you see its tools. Mark the ones that read: list the projects, read a note, search. Leave the ones that write: update a task, send a message. The gate lets the marked ones through and suspends the rest.\nThe caveat\nIf you mark a tool that writes as read-only, the gate lets it through. The rule trusts your marking. Mark carefully and read the tool descriptions.\nWho decides\nA person of the workspace, in the approvals inbox. The decision is recorded and the agent is told with a signed call. Your own AI, if it talks to your agents through Geenius OS, can read the queue and cannot answer it. We did that on purpose. If an AI could approve, an AI could approve its own webhook, and then the gate would only be a speed bump.\nWhat a denied call looks like\nThe model is told that the call failed because the owner denied it, and it can say so in its answer. Nothing happened.\nSee the risk rule and approvals."
  },
  {
   "id": "https://agenthost.geenius.io/blog/a-digest-while-you-sleep/",
   "url": "https://agenthost.geenius.io/blog/a-digest-while-you-sleep/",
   "title": "A digest while you sleep",
   "summary": "How to set up an Agent host agent that wakes on a schedule, reads the pages you follow and leaves a short digest you read in the morning.",
   "date_published": "2026-10-18T09:00:00Z",
   "authors": [
    {
     "name": "The Agent host team"
    }
   ],
   "tags": [
    "schedules",
    "how-to"
   ],
   "content_text": "Following ten pages by hand is a chore. An agent can do it for you, on a schedule, and leave a short digest.\nSet it up\nStart from the research digest template. In its instructions, name the pages and topics you care about, and say how you want the digest: short, with what changed and what did not. Turn on web fetch, which is a safe tool. Give it a schedule: every morning is every 1,440 minutes, and the shortest your plan allows is 60 minutes on Pro, 5 on Premium and 1 on Max. Then deploy.\nWhat happens\nAt the interval the agent wakes, receives your prompt, fetches the pages, compares them with what it remembers and writes the digest. The last result is kept, so you can read it in the app, or ask your own AI to read it through Geenius OS. Each run is logged with its steps and its cost.\nWhat it cannot do alone\nIf the digest agent had a webhook to post the result somewhere, that call would be risky and would wait for you, even in a scheduled run. Most digest agents need no risky tool at all, which is the best case.\nCost\nOn Pro your own key pays, and no credit is counted. On Premium and Max a run costs credits by the model tier, so a small tier is a good default for a digest. The plan's daily tool-call limit is a hard stop: if an agent loops, it stops for the day instead of running up a bill.\nKeep it honest\nAn agent that reads the web can read something wrong. Ask it to say where each point came from, and keep the instructions saying that text from pages is data, not instructions. Check the digest before you act on it.\nA good first schedule\nDaily is plenty. Start there, read a week of digests, then decide whether you need it more often.\nSee schedules."
  },
  {
   "id": "https://agenthost.geenius.io/blog/pro-brings-its-own-key/",
   "url": "https://agenthost.geenius.io/blog/pro-brings-its-own-key/",
   "title": "Why Pro brings its own model key",
   "summary": "How Agent host pays for models: your own key on Pro, built-in credits on Premium and Max, and why the deployment's keys are never used for Pro.",
   "date_published": "2026-10-18T09:00:00Z",
   "authors": [
    {
     "name": "The Agent host team"
    }
   ],
   "tags": [
    "models",
    "credits"
   ],
   "content_text": "An always-on agent calls a model many times. Someone pays for that. Agent host gives you two ways.\nPro: your own key\nOn Pro you add your own model key. The app seals it: it is never shown again. Only your provider's model is called with it. The deployment's own keys are never used for a Pro workspace, and no credit is counted. Pro costs the same whether your agent talks a lot or a little, and your model bill goes to your provider.\nPremium and Max: credits\nOn Premium and Max the built-in AI answers, using the deployment's keys, and a model step costs credits. Premium has 1,000 a month and Max 3,000. A step costs more with a larger model: a small tier costs the least, and the largest costs the most.\nWhat we do not say\nWe do not quote the cost per tier. The rates are an assumption that we want to check against the providers' price lists before plans are sold, and quoting them now would be quoting a guess. The plan limits too are current values that may change during early access.\nA hard stop\nThe tool calls a day are a hard stop, not a bill. An agent that makes too many calls stops for the day. That protects you from a loop more than any alert would.\nWhich is better\nIf you already have a model account and want one agent, Pro is simple and predictable. If you want several agents and do not want to manage a key, Premium or Max is easier, and the credits show you what each run cost in the logs.\nWhat a model provider sees\nWhatever you and the agent say, and what the tools return, is sent to the model that answers. On Pro that is your own provider under your own terms. We say this plainly because it is true of any agent.\nSee models and keys and credits and usage."
  },
  {
   "id": "https://agenthost.geenius.io/blog/your-ai-can-watch-not-approve/",
   "url": "https://agenthost.geenius.io/blog/your-ai-can-watch-not-approve/",
   "title": "Your AI can watch your agents. It cannot approve them.",
   "summary": "How your own AI works with Agent host through Geenius OS: it lists agents, talks to them and reads digests and approvals, but has no approve action by design.",
   "date_published": "2026-10-18T09:00:00Z",
   "authors": [
    {
     "name": "The Agent host team"
    }
   ],
   "tags": [
    "ai",
    "safety"
   ],
   "content_text": "If you already work with an AI, it is natural to ask it about your agents. Agent host lets it, with one deliberate gap.\nWhat it can do\nThrough Geenius OS your AI gets a tool called geenius_agenthost with one area, agents, and six actions. It can list the agents with their state, get one with its versions and connectors, send one message to a deployed agent and read the answer, read the approvals queue, read the last digest of a scheduled agent and check usage.\nWhat it cannot do\nIt cannot approve or deny anything. It cannot create or change an agent. It cannot read a connector secret, because nothing returns one. Those are for people, in the app.\nWhy no approve\nThe approval gate exists so that an agent cannot do something risky on its own. If another AI could answer the approval, the question would just move: an AI that talks to an agent could approve the agent's webhook. We took the approve action out of the door altogether so that there is nothing to misuse.\nWhat a risky action looks like through the door\nYour AI sends a message. If the agent decides to make a risky call, the answer comes back as pending approval with an id, and the agent waits. Your AI can tell you there is something waiting. You open the app, read what it wants and decide.\nA first ask\nAsk your AI to list your agents, say which are running, and read the last digest of the research agent, without sending anything. It reads, it summarises and you stay in charge.\nWhy it is still useful\nA lot of the value is in reading. Ask your AI each morning which agents ran, whether any is waiting on you and what the last digest said, and you get a short briefing without opening the app. If something is waiting, you open the approvals inbox and decide. The loop is: your AI notices, you decide, the agent continues. That keeps the speed of an assistant and the safety of a gate.\nOn which plans\nThe door is on every plan. During early access people request access, and payments are in test mode.\nSee use with your AI."
  },
  {
   "id": "https://agenthost.geenius.io/blog/ask-first-is-a-feature/",
   "url": "https://agenthost.geenius.io/blog/ask-first-is-a-feature/",
   "title": "Asking first is a feature, not a limit",
   "summary": "Why an agent that stops and asks before risky actions is more useful than one that never does, and how to design agents so that they ask rarely.",
   "date_published": "2026-10-18T09:00:00Z",
   "authors": [
    {
     "name": "The Agent host team"
    }
   ],
   "tags": [
    "approvals",
    "craft"
   ],
   "content_text": "Some people see an approval as friction. We see it as the thing that lets you leave an agent running.\nTrust is built on the stop\nYou would not give a new colleague the keys to everything on day one. You would let them read, sort and draft, and ask you before they send or change anything. After a few weeks you would tell them what they can do alone. An agent that asks first lets you do the same, and the list of what it may do alone is the list of tools you marked safe.\nDesign agents that ask rarely\nThe best agents rarely need to ask, because their job is mostly reading. A triage agent reads and drafts, and its drafts are text, not actions. A digest agent reads pages. A project reporter reads tasks. For those, nothing is risky and the inbox stays empty. Reserve the tools that write for agents whose job needs them, and expect those to ask.\nMake the ask readable\nAn approval says what the agent wants to do, which agent and since when. You decide faster when the agent's instructions tell it to explain what it is about to do and why before it calls a risky tool.\nDo not mark your way around it\nMarking a tool read-only is a promise that it only reads. If you mark a write tool read-only because the questions annoy you, you have turned the gate off for it. Better to narrow what the agent can reach, or to have a person run that step.\nDenials teach\nWhen you deny a call, the agent is told that it failed because you declined, and it can adapt. Over time you will see which asks are noise and which matter, and you can change the instructions or the tools accordingly. Every change is a version, so you can go back.\nThe result\nAn agent you do not have to watch, because it stops where it should. That is the whole point of Agent host.\nSee approvals and the risk rule."
  }
 ]
}