# How To Limit Assistant Tools With BetterShield?

Choose the security tools a connected AI app may use and understand how they intersect with read and change permissions.

With **[BetterShield](/)**, choose the security tools a connected AI app may use and understand how they intersect with read and change permissions.

## What it does

Each connected AI app can be limited to the tools you choose. This is an additional boundary: it does not grant access that the site’s read/write switches, credential scope or account permissions forbid.

<span id="set-it-up" aria-hidden="true"></span>

## Step 1: Open BetterShield › Agents › Connect

Open **BetterShield › Agents › Connect**.

<figure class="doc-shot">
  <img src="/docs/screenshots/assistant-tool-limits.png" alt="What a connected assistant can do explains the tools and access offered to a connection." width="982" height="100" loading="lazy" decoding="async">
  <figcaption>What a connected assistant can do explains the tools and access offered to a connection.</figcaption>
</figure>

## Step 2: Limit the tools offered to each connected app

- Find the connected app and open **Tools**.
- Review the offered tools and keep only those required for the app’s job.
- Select **Save Tools**. The app sees the saved selection the next time it reads its tool list.
- Ask the app to refresh its tool list or reconnect before testing.

## Recommended settings

Our advice is to start with reading and checking. Give each app a separate connection and a reviewed tool selection. Do not share a credential between unrelated operators.

## What it can break and how to undo

An app that loses a required tool can no longer complete that workflow. Restore that tool and save, provided the underlying site permission is still appropriate. Removing a tool does not undo actions already completed.

<span id="check-it-is-working" aria-hidden="true"></span>

## Final Outcome

Refresh the app’s tool list and confirm the chosen tools are offered. A tool excluded from this connection should not become callable merely because another app can use it.

<figure class="doc-shot">
  <img src="/docs/screenshots/assistant-tool-limits.png" alt="What a connected assistant can do explains the tools and access offered to a connection." width="982" height="100" loading="lazy" decoding="async">
  <figcaption>What a connected assistant can do explains the tools and access offered to a connection.</figcaption>
</figure>

## Related

- [Assistant connections](/docs/assistant-connections/)
- [Agent read access](/docs/agent-read-access/)
- [Agent change access](/docs/agent-change-access/)

This is how you can limit assistant tools with BetterShield.

Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).