Agent tools
What the planning agent is allowed to do as you, and how to change it.
The planning agent acts as you. When it reads a repository, attaches a document or pushes a plan, it does so with your access and nothing more.
Settings → Agent tools in your profile is where you decide which of those things it may do without asking.
It is a personal setting
Your tool permissions are yours. They are not a workspace policy, and changing them affects your conversations only.
That is the right shape because the permissions are bounded by your own access anyway. The agent cannot reach a plan you cannot reach, or a repository you never connected, whatever this screen says.
What it covers
The controls cover the actions with a side effect outside the conversation: reading connected repositories, searching the web, fetching a page, writing to your issue tracker.
Turning one off does not break planning. The agent tells you it needs that action and asks, rather than silently producing a worse plan.
Nothing here can widen your access. It only narrows what the agent may do on your behalf, which means the safe default is to leave it alone until you have a reason not to.