Agent Zero 2.15 separates permissions for individual tool actions Agent Zero 2.15 separates permissions for individual tool actions

A tool can expose reads without writes

The Agent Editor now expands tools into individual operations. An operator can allow the text editor’s read action while blocking write and patch actions. Each operation has an explicit allow, explicit block or inherited default. Category defaults affect entries that still inherit them, while pinned choices remain unchanged. Whole-tool controls apply to every action, including those hidden by a search filter. Explicit blocks take precedence across tool and action rules. The editor records overrides in the selected global or project profile, shows the exact file changes before saving, and leaves bundled profile definitions untouched. Saving a profile can open a fresh test chat without changing the old chat’s history.

The plugin boundary changes too

The release moves several bundled capabilities, including search, notifications and scheduling, into standalone plugins. Four memory tools become one tool with an action argument. Legacy memory calls remain compatible, while custom integrations are directed toward the new interface. Remote input also gains an additional permission check: enabling input_remote alone no longer permits terminal access when the remote terminal permission is blocked.

Telegram separates conversation access from administration

Telegram now requires a separate administrator list for plugin and permission changes. An administrator must also pass the bot’s ordinary sender allowlist. An empty administrator list gives nobody access to those settings. The handler uses the current bot configuration for each message and callback, so removing an administrator also invalidates previously displayed menu buttons. Bot activation and access rules apply globally. Older project or profile overrides pause delivery until reviewed and removed. Existing files are preserved without automatic merging; the settings interface exposes those copies for inspection before the intended global rules are applied.

WhatsApp checks the current sender

WhatsApp similarly separates allowed correspondents from administrators through admin_numbers. Administrative access also depends on sender and group checks. Membership comes from the current message’s normalized number, rather than the previous participant in that chat. The integration reserves plugin changes, tool policies, profile definitions and browser-runtime changes for administrators. Permission edits use the Agent Editor’s writer and require the active run to stop. Ordinary conversation commands remain available through text menus. Sender and group authorization checks run before media downloads and again before dispatch, separating message admission from later administrative operations.

Connected browsers need a fresh session

The browser helper moves to version 2 with same-origin enforcement for its message channel. Existing host browsers must restart and reconnect so their old initialization scripts are discarded.