What an agent can and cannot do
An AI agent works in your organization under the app's rules. What it may do in each area, the decisions that always stay with a person, and how a refusal comes back.
TL;DRAI summary
An AI agent in Cypress acts like a team member with specific permissions. This chapter explains what an agent can and cannot do for different tasks, helping you understand when a human decision is still required.
An AI agent in Cypress is a member of your team with its own name and the AI agent role. It works through the same code as a person on the app's screens, with a fleet manager's authority on the actions an agent may run. Some decisions are never an agent's, whoever asks. This page lists both, area by area. The full answer for every action is the Agent column of The app's actions.
An agent is a member of your team
- It comes with an app. An app connected through Connect Cypress may add agents when an admin approves it. Each agent has a name ("Cedar Sell", say) and the scopes the admin approved for it, never more than the app's.
- It acts under its own name. Everything it does is recorded in the activity log as the agent, never as a person. A task it made says Made by an agent.
- It cannot sign in. It has no password and no screen. It works through the API and the MCP servers, with a token that lasts an hour.
- It follows its app. Disconnecting the app switches its agents off at once.
Area by area
| Area | An agent does | Stays with a person |
|---|---|---|
| Vehicles and listings | Reads the fleet and every car. Adds cars and edits their details (add_vehicle, edit_vehicle), labels, photos, videos, the inspection report, share links, visibility and the storefront. Submits cars for review (submit_vehicles_for_review), puts a car on the market (launch_vehicle) and pauses one (pause_vehicle). Sets the listing price under the limits: at or above the floor, never while a live offer or a sale is open (set_listing_prices, update_listing, edit_vehicle). Asks for a new valuation (revalue_vehicle) | The floor (set_floor_prices, or a floor on any call), and a listing price below it. Resuming a car or taking it off the market (resume_vehicle, delist_vehicle). Deleting cars (delete_vehicles), changing a status by hand (change_vehicle_status), offer rules and pricing rules (set_vehicle_offer_rules, apply_pricing_rule), imports (import_vehicles) |
| Offers | Reads offers. Accepts, declines, counters and withdraws them (accept_offer, decline_offer, counter_offer, withdraw_offer) | Accepting or countering below the floor |
| Buying on the Marketplace | Searches, saves cars and sets alerts (save_vehicle, create_marketplace_alert) | Making an offer, buying now and answering a counter (make_offer, buy_vehicle_now, accept_counter_offer, counter_back_offer) |
| CRM and tasks | Contacts, companies, deals, notes, interactions, tags and tasks (create_contact, move_deal_stage, create_task). Links a deal to its contacts and cars (add_deal_contact, add_deal_vehicles) | Emailing a contact (email_contact). Deleting a contact, a company or a deal (delete_contact, delete_business, delete_deal). Importing a CRM file (import_crm_records) |
| Marketing | Drafts and edits campaigns and promotions, writes message templates, estimates an audience, pauses a campaign (set_campaign_content, create_promotion, pause_campaign) | Activating or sending a campaign (activate_campaign, send_campaign_now) and sending a test (send_campaign_test). Mailing a pasted list of addresses. Publishing a template or a promotion (publish_message_template, publish_promotion) |
| Closings | Reads closings. Reminds whoever's turn it is, asks for a missing document, re-sends a signing link, marks its own side's steps (remind_closing_step, request_closing_document, resend_signing_link, mark_closing_step). Reports and answers incidents (report_closing_incident) | Confirming that money arrived, which releases the car. Deal Setup, uploading, generating and sending documents for signature (upload_closing_document, send_closing_document_for_signature). The commission |
| Planning | Prepares the plan: the mandate and goals, Sequoia's schedule, moves and groups, costs, and answers to Sequoia's decisions (add_sell_goal, apply_sell_schedule, schedule_plan_vehicles, answer_sell_decision). The buy draft and targets (keep_buy_draft, create_buy_target) | Approving a quarter, Sell or Buy (approve_sell_quarter, approve_buy_quarter). Adding or removing a track (add_plan_track, remove_plan_track). Asking Cypress for Planning (request_planning) |
| Automations | Drafts, tries (a dry run), submits for publishing and switches off (create_automation, dry_run_automation, submit_automation, deactivate_automation) | Switching an automation back on (activate_automation). Cypress publishes every draft |
| Your organization | Locations, transporters, title addresses and custom fields (create_location, create_custom_field). Reads the team (list_members) | The profile, members and roles, bank accounts, lenders, billing, documents, seller terms and what Cypress may do for you (update_organization_profile, invite_member, create_bank_account, set_seller_terms, set_cypress_delegation) |
Never, at any level: signing a document, accepting terms, changing billing or managing the team. The routes that do these refuse an agent's token outright. Neither can an agent run a Cypress staff action: those take a Cypress Manager's own token.
What a write answers
Every write, through any door, answers one of three ways:
| Answer | Over MCP | Over REST | What to do |
|---|---|---|---|
| Done | The record, or with dryRun what would change | 200 or 201 with the record | Carry on |
| Refused | isError: true, the reason, and a code | A 4xx with the same code and reason | Fix what it names (INVALID with each field, NOT_FOUND, CONFLICT for a state that does not allow it, SCOPE_MISSING) and try again |
| A person's decision | status: NEEDS_PERSON, the reason, a decisionLink | 403 with PEOPLE_ONLY, POLICY_DENIED or BELOW_FLOOR | Hand the link to a person; do not retry |
A dry run answers the same way as the real call would, writing nothing. See Errors for every code.
How a refusal comes back
When an agent asks for something that is a person's, nothing is done. The answer says why, in words a person can act on.
Over MCP (Cypress Operate), the tool answers with a decision instead of an error, so the agent can hand it over:
{
"status": "NEEDS_PERSON",
"code": "PEOPLE_ONLY",
"message": "An email in your organization's name goes out from a person. Log what happened, or give a person the task.",
"decisionLink": "/go/contact/…"
}decisionLink is always there. It opens the record in Cypress, where a person
makes the call, or, for a decision that names no record (inviting a member,
approving a quarter), the screen where a person makes it. A
well-behaved agent gives the link to a person (a task, a message) and does
not retry.
Over REST, the same refusal is 403 with "code": "PEOPLE_ONLY" and the
same message. See Errors.
What the agent is told, for each decision kept for a person:
| The agent asked to | It is told |
|---|---|
| Accept an offer below the floor | Accepting an offer below the floor is for a person at the seller, never an integration or an agent. |
| Counter below the floor | A counter below the floor is for a person at the seller, never an integration or an agent. |
| Set or change the floor | The floor is the seller's reserve: only a person at the seller sets or changes it. |
| Set a listing price below the floor | Choose a listing price at or above the floor. |
| Take a car off the market | Taking a car off market is a person's decision: pause the listing (status PAUSED) and ask a person to cancel it. |
| Email a contact | An email in your organization's name goes out from a person. Log what happened, or give a person the task. |
| Activate or send a campaign | An agent drafts and pauses campaigns; a person activates and sends them |
| Switch an automation back on | An agent drafts, tries, submits and switches off automations; a person switches one back on |
| Approve a quarter | Approving a quarter is a person's: an agent prepares the plan, a person approves it. |
| Confirm that money arrived | Confirming that money arrived releases the car: a person confirms it, or your bank or accounting integration |
Rules that hold for everyone
Agents get no rules of their own beyond the decisions above. Everything else applies to every caller, person or software:
- The floor is a promise. No rule, automation, app or agent sells a car below its floor. Only a person at the seller can, by hand, and the activity log records who.
- You see only what is yours. An agent reads your organization's records and the deals it is part of, never another seller's floor or buyers. The privacy rules are the app's.
- Check first, act once. Every write takes
dryRun(every check, nothing written) andidempotencyKey(a retry answers the first answer). A good agent does a dry run before anything it can't take back. - Try it in a sandbox. In a sandbox the rules are the same and nothing reaches a real person. The MCP quickstart walks through it.
Agents, apps and API keys
The decisions on this page are an agent's limits. An API key, or an app acting for one of your people, is held to the same rules as a person in the app, and to a few of its own: a key never emails a contact in your name, and never accepts below the floor. Who each credential acts as is in Keys and tokens.
MCP quickstart
Connect an AI agent to a Cypress sandbox in about ten minutes. List the fleet, put a car on the market with a dry run first, and meet a decision Cypress keeps for a person.
Keys and tokens
The credentials an app or an agent uses to work in Cypress, who each one acts as, where it is made, and how to show an agent only the tools its job needs.