Link a Specialist to a Code Base
A code base is connected once per tenant, in Settings. Before this grant existed, connecting it there was also the only control there was — any Specialist holding the code-search Capabilities could read every connected repository, with no way to stop one Specialist reading a repository meant for a different team. This article covers the fix: a per-Specialist grant, made from the Specialist’s own Knowledge tab, that says which repositories it may search and what it may say about what it found.
Connecting a repository itself hasn’t moved. Connecting still happens in Settings because it needs GitHub permission and costs storage — that’s a tenant-level act. Deciding which Specialist gets to read that repository is a different decision, and it now lives in the Agent Stack, on the same Knowledge tab as Knowledge Base, Handbook, Library and Documents — the same split those Library packs already use.
Before you start
- The repository you want to grant must already be connected in Settings. If nothing is connected for the tenant, the Code bases card doesn’t appear on any Specialist’s Knowledge tab — there’s nothing to pick from.
- The Specialist needs the code-search Capabilities to make use of a grant at all. A grant with no matching Capability, or a Capability with no grant, isn’t useful on its own — a Specialist that holds the Capabilities but has been given no grant now gets an error when it tries to search code, rather than falling back to reading everything, which is the exact bug this feature closes.
Open the Code bases card
- Go to the Agent Stack and open the Specialist you want to configure.
- Open its Knowledge tab.
- Scroll to the Code bases card — it is the last card on the tab, below Knowledge Base, Handbook, Library and Documents.
Choose which repositories this Specialist can search
The card lists the tenant’s connected repositories as checkboxes. Check the ones this Specialist should be able to search, and leave the rest unchecked.
Sync state is per repository, not per grant, so it reads the same no matter which Specialist you’re configuring. A repository that has never finished a sync is listed and can be ticked, but nothing can search it until that first sync lands. One whose last sync failed is flagged on the card too — though it keeps serving the last copy that did sync, so a granted Specialist can still search it. Only a disabled code base, or one that has never synced successfully, is genuinely unreadable.
Two Specialists can be given different subsets of the same connected repositories. That’s the point: a tenant with one repository for a support team and another for an internal engineering team can grant each Specialist only its own, instead of both reading both.
Choose what it’s allowed to say
Once at least one repository is checked, a What it may say group appears below the list. Pick one of its two options for this Specialist:
- Answer in product terms — Never quotes code, never names a file, and never says it read the source. — The default, and the only safe choice for a Specialist a customer talks to.
- May cite file and line — Answers can include a file path and line number. — Only for a Specialist customers never talk to — an internal or engineering-facing Specialist where a precise citation is useful.
This is one setting for the whole card, not one per repository — it describes how the Specialist is allowed to talk, not which repository it read. Setting it applies across every repository you’ve checked for that Specialist.
Don’t grant May cite file and line to a customer-facing Specialist. If an answer draws on more than one repository, or on more than one Specialist’s grant during a voice call, the strictest disclosure among them wins — so a single product_terms grant on a call is enough to keep a file path or line number out of what’s said to the caller, even if another Specialist on the same stack was set to cite source.
Save
Saves go out as you toggle checkboxes or change the disclosure option — there’s no separate submit button. The controls stay responsive while a save is in flight, and saves for one Specialist are queued rather than run in parallel, so two fast clicks can’t land out of order and store the older set. If a save fails, the card re-reads the grant from the server instead of restoring whatever was on screen — the server is the only party that knows which of the queued saves landed.
What changes for the Specialist
- It can only search the repositories checked for it here — not every connected repository.
- Its answers are held to the disclosure option chosen here, and to the stricter option whenever its answer draws on another Specialist’s grant too.
- If it holds the code-search Capabilities but has no grant at all, it errors on a code search rather than reading every repository.