SoftTech AI Registry
Glean · Glean Agents

Agent tool execution

Glean Agents invoke configured tools (native tools, custom actions and MCP-backed tools) during interactive, app/event-driven, scheduled and background runs. In Auto mode and in Plan and execute steps the AI selects tools, predicts inputs, invokes them and reasons over results; other Workflow mode steps are builder-defined. Excludes Independent Agents.

Recorded characteristics

Function
Glean documents that in Auto mode the agent "determines the execution path": the AI selects tools, predicts tool inputs, invokes tools, reasons over results and can perform multi-step execution. Workflow mode lets builders define more explicit steps; not every Workflow step is autonomous AI tool selection. Plan and execute steps introduce AI-selected tool execution within Workflow mode, including supported MCP tools (MCP tools are available only in Plan and execute steps and Auto mode agents). The capability is recorded as can_take_actions because documented execution includes AI-selected, AI-invoked tools; write tools execute based on AI-predicted values. Auto and Workflow mode differ in how execution is planned and built, not in confirmation, permissions or triggers (Workflow mode has an extra scheduling activation step); some tools exist in only one mode. Execution contexts kept in this one capability: interactive runs, app/event-driven runs where supported (e.g. Slack message or webhook triggers), scheduled runs and background runs. Documented persistent writes: creating and editing tickets, posting comments, updating fields and records, Jira and Jira Service Management actions, creating Google Docs, creating Google Sheets, saving Gmail drafts (saved in Gmail, not sent), and sending Slack messages. Tool boundary: indexed connectors, native tools, custom actions and MCP-backed tools are distinct; a connector existing in Glean does not mean every action is available to an Agent — tools must be enabled for Agents, added to the agent, and may be restricted to particular users or groups; not every connector exposes write tools.
Data access
Determined by the tools added to the agent and the authority each tool uses. By default an agent runs under the identity of the invoking user; other authority modes are described under limitations (permission basis).
Actions
Can take actions
External actions
Yes
Human confirmation
Conditional
Permission basis
Mixed
Administrative control
Runtime confirmation: read-only tools generally run without confirmation by default. Write tools normally require user confirmation unless no-confirmation execution is permitted through two layers: (1) administrator eligibility ("Run without user confirmation", per connector, or per tool for custom actions and MCP tools) AND (2) the builder enabling it for the relevant step. Some tools (such as those using the LLM to predict inputs) always require confirmation. Interactive execution without confirmation requires user consent, and re-consent after a new agent version; Assistant/general chat settings do not change agent behaviour. Background/scheduled: actions still requiring confirmation cannot complete in a scheduled or background run; if a scheduled run reaches a step requiring confirmation, Glean emails the user rather than bypassing it. Tool-type defaults: new custom actions default to eligible (older ones stay ineligible until an admin changes them); MCP write tools from newly connected servers default to allowed; new tool packs start with the builder-level no-confirmation option unchecked; no universal default is established for native write tools. September 24, 2026 release (current-state evidence only, no change event): existing per-tool approval settings are now enforced across additional tool packs and MCP tools, and agents waiting on approval now show greyed out. Scheduling: off by default; administrators grant scheduling access (Admin console > Platform > Agents > Scheduled triggers) to everyone or chosen users/groups; each user activates their own schedule; Auto mode configures the schedule in the builder; Workflow mode requires "Allow agent to run on a schedule" plus activation after publishing; maximum run time applies. Governance: agent creation, sharing and publishing permissions; Agent Creator role; publishing approval (kept separate from runtime confirmation); moderators/department moderators; tool availability per surface and per tool with user/group restriction; role-based MCP access; scheduling permissions; confirmation eligibility; admin agent disabling. Observability: Debug and trace views showing execution path, tool calls, prompts and steps; historical runs with Agents and Automations filters; agent trace export via OTLP available to admins without a support request as of September 24, 2026. Glean states audit logs continue to apply and that with agent identity actions are attributed to the agent in the audit log; recorded as Glean's documented behaviour, not verified complete audit coverage.
Default state
Conditional
Availability
Default is conditional: depends on Glean Agents being available to the organisation, creator/user permissions, tool configuration and enabling for Agents, tools being added to the agent, connector/authentication setup, the no-confirmation controls, and scheduling enablement (off by default). Glean Agents is actively documented; no GA date is recorded. Scheduled triggers carry no Beta label; no GA date is inferred. Independent Agents are Beta and excluded. Plan and regional availability not established.
Licensing
Plan requirements not established.
External model or provider
No single fixed model or provider. Reasoning mode Fast or Thinking; model selection where the organisation's configuration offers it. No default provider established.
Limitations and uncertainty
External action = yes relative to the Glean Agents boundary: documented tools persistently change systems outside Glean (Jira, Google Docs, Google Sheets, Gmail drafts, Slack, connected-system records). Permission basis = mixed; authority modes within this capability: (A) user identity — by default an agent runs under the invoking user's identity, and newer Docs/Sheets/Gmail tools use each person's own connection; (B) delegated on-behalf-of-user authority — older Google tooling uses centrally configured domain-wide delegation acting on behalf of the logged-in Glean user (not equated with a personal OAuth connection); (C) shared/admin-authorised credentials — e.g. MCP OAuth Admin (one admin-authorised connection) and API key authentication; (D) machine/client credentials — MCP client-credentials authentication; (E) service credentials / agent identity — admin-created, scoped service credentials can be attached to an ordinary agent so it acts under an agent/bot identity. Not every ordinary agent has its own identity. MCP: OAuth uses PKCE; OAuth User requires individual authorisation; not all MCP authentication modes preserve individual-user permissions. Excluded: Independent Agents (Beta; dedicated agent identity, lasting presence, event/message/schedule triggers, scoped service credentials, separate admin governance) — future candidate. Unresolved: (1) "Always allow" / "Needs approval" terminology not verified; (2) Drive file/folder creation, sharing and permission operations not verified; (3) conflict: the in-line execution page says in-line execution is "Not supported for custom tools", while the eligibility page indicates builders can skip confirmation for custom-action steps in interactive agents; (4) default no-confirmation settings for each native write tool not established; (5) user-level authority where an MCP server uses administrator-level authentication not fully established; (6) no GA date; (7) plan and regional restrictions not established; (8) completeness of audit coverage outside agent-identity execution not established.

Evidence