> ## Documentation Index > Fetch the complete documentation index at: https://guides.runner.now/llms.txt > Use this file to discover all available pages before exploring further. # Tool permissions > Decide, tool by tool, what Runner can read, change, or send. Tool permissions control what Runner can read, change, or send on each connected account. Every connected app is a bundle of tools. Gmail has "search inbox" and "send email." Those tools have separate settings, so Runner can read while every send waits for review. ## The four settings Open **Connected Apps**, select an account under **Connected**, and find **Tools**. | Setting | What it means | | --------- | ------------------------------------------------------------------------------------------------ | | **On** | Runner can read with this tool. Reading tools only. | | **Allow** | Runner performs this action without asking. | | **Ask** | Runner stages an **Action Card** for the action and waits for your approval. | | **Off** | Runner can't use this tool with this account, unless you've allowed it in a user-created Runner. | **Staging an Action Card does not perform the action.** Review it, then approve or reject it. A pending **Action Card** expires 24 hours after Runner stages it. If it expires, the action hasn't happened and the card can no longer be approved. Ask Runner to stage it again if you still want it. *** ## Settings are per account A tool setting applies to the connected account you're viewing. If you connect two Gmail accounts, sending can be **Ask** for work and **Allow** for personal. Changing one doesn't change the other. *** ## A setup that works Why not allow everything? Because **Allow** skips review. Start with this: 1. **Start with reads on and writes on Ask.** Runner can read, while proposed writes wait for your approval. 2. **Move routine actions to Allow when you're ready.** Runner will perform those actions without an **Action Card**. 3. **Keep sending and hard-to-undo changes on Ask.** Email sends, Slack posts, and deal updates wait as **Action Cards**. 4. **Use Off when the tool shouldn't run.** A user-created Runner can still override **Off** for its own runs. Keep payments, legal submissions, relationship-sensitive messages, and hard-to-reverse changes on **Ask** or **Off**. *** ## Runner-specific overrides Your **Connected Apps** setting is the baseline. On a user-created Runner, open **Tool permissions** to add an override. Anything you don't override stays **Inherited** and uses the **Connected Apps** setting. The Runner override takes priority during that Runner's runs, including over **Off**. It applies to that tool across the connected accounts the Runner uses. For example: * An inbox-triage Runner can use **Allow** for archiving while the connected account stays on **Ask** elsewhere. * A research Runner can set its write tools to **Off** during its runs. * A user-created Runner can use a tool that's **Off** outside that Runner. Built-in Runners are the exception. **Heartbeat** and **Daily Brief** don't have per-Runner overrides. They use the tool settings in **Connected Apps**. *** ## What's next? See how each Runner gets a saved job, schedule, and tool settings. Bring custom tools into Runner, with the same controls.