Agent access
Open Settings → Agent Access in Thermal →
What it's for
Agent access is where you let an outside agent, such as Claude Code or Codex, work in Thermal on your behalf. You copy one setup prompt into the agent, sign in through your browser, and it can read your schedule and propose changes. This screen also shows what each connected agent may do, lets you revoke one, and lists what the agents have done.
Reach it from Settings → Data → Agent access in the sidebar, at
/settings/agent-access.
Tabs
This screen has no tabs. It is one page with four sections.
Panels and controls
Set up an agent
Copy setup prompt copies a short set of instructions. They tell the agent
to install the Thermal command line tool and skill, run thermal login,
which opens your browser so you sign in and pick your organization, and run
thermal whoami to confirm. The prompt holds no password and no key. The
versions it names are shown under it.
What an agent may do
Each connected agent has a ceiling:
- Read — it can look things up and cannot change anything.
- Flag — it can propose a change for a person to approve, and cannot apply it on its own.
- Write — it can apply changes within your role and its usage ceiling.
An agent that causes a serious failure, such as reaching data outside its organization, is lowered to Read automatically. Only a person can raise it again.
Connected agents
Each agent shows its name, identifier, ceiling, when it was last used, and its usage against the ceiling for the current 30-day window. Revoke stops the agent on its next request.
Agent activity
The latest actions taken by connected agents: what they did, the outcome, and the reason they gave. Actions by people and by the system are not listed here.
What it accepts
The only form on this screen is Revoke, which asks you to confirm.
How to configure it
- Paste the setup prompt into your agent and follow the browser sign-in.
- Revoke any agent you no longer use. Revoking is immediate.
Who can see it
This screen sits behind the Integrations area.
Owners can open it. Office managers and dispatchers and technicians cannot. The gate is checked on the server, not just hidden in the sidebar, so a direct link does not get around it.
The full role matrix is on Roles & permissions.