Contained Agents

A contained agent is an agent you create that does one job in a sealed space. It can use only what you grant it, it follows instructions written for that job, and it can never act with your agents' full rights. Being contained is one setting of the agent; the same agent can then be reached in three ways:

• in the app, by the people of your team who see it;
• on a page of your workspace, as a chat block (signed-in people only);
• on your websites, as a chat window that anyone may use (visitors).

Use it for a customer support assistant on your website, for an internal helper that answers from your own documents, or for agents you build once and rent out to clients: each one does its job and nothing more.

What a contained agent can and cannot do

A contained agent can:

• answer from the knowledge you give it (see below);
• use skills you have explicitly granted it, if those skills declare no dangerous capability;
• on your websites: hand the conversation to a person from your team.

A contained agent cannot, whatever anyone asks or types:

• see your server's files, settings, credentials or other conversations;
• use the platform's API beyond what you granted it;
• browse the web, send email or take any action outside its own answer;
• run with your agents' normal rights. If you switch it from contained back to a normal agent, its visitor conversations are refused, never run with full power;
• start background work or run on a schedule.

Its answers are plain text. On your websites, links are only clickable when they point to one of the websites you listed for the chat. Anything else is shown as text, and images are shown as their description.

What to give it: only what it needs for its job

Give a contained agent only what its job needs. If visitors may talk to it, give it only information you would put on your public website: product descriptions, prices, opening hours, your FAQ, your returns policy, how to reach you.

• Never give it credentials (passwords, keys, tokens): it can't use them in this version, and anyone who can talk to it could get it to repeat them, for example by asking it to rephrase or encode them. If visitors may talk to it, also leave out internal documents and personal data: treat everything you grant as public. For an agent only your team uses, treat everything you grant as visible to every member.
• Grant documents deliberately. Grant only the project documents that are meant for the people it talks to.
• Write its instructions for the contained space. In the sealed space an agent never uses the instructions you wrote for your team. It runs on its own instructions for the contained space (up to 16,000 characters). If you leave them empty, CRHQ uses a plain default: for visitors, a support assistant (answer from the knowledge you are given, keep it short and friendly, never invent facts, and offer a person when unsure); for your team, a helpful assistant with limited access.
• Never paste an agent's normal instructions into them. Those are written for an agent that works inside your CRHQ server (its folders, its status board, its tools). None of that exists in the sealed space, and it is not something visitors should read. CRHQ refuses to save instructions that contain such platform text or anything that looks like a password or key, and tells you which part to remove.

Step 1: make the agent contained

1. In the Canvas workspace, go to Settings → Agents and open an agent you created (or create a new one for this job). Built-in and organization-managed agents cannot be contained: make a separate agent for the job.
2. In its Contained section, switch Contained on. The first time on this server, press Set up on this server and wait until it is ready (about 6 GB of free disk space needed; about 4 GB used).
3. If people outside your team should reach it on your websites, switch Anyone can talk to it (visitors) on.
4. Fill in its Instructions for the contained space, its Model, the Tools inside the space, the Skills it may read and its spending caps (the defaults are filled in; change them if you like).
5. Save. Only an administrator signed in to CRHQ can do this. API keys and agents cannot change it.

Step 2: choose where people reach it

In the app

Your team uses it like any agent: the people whose roles show the agent can start a conversation with it. Roles decide who sees the agent; every conversation runs in the sealed space.

On a page (signed-in people only)

Put the chat right on a page of your workspace: on an agent page, set "inline": true and the page shows the chat itself instead of a "Start a session" button (code pages use ui.Chat). Only signed-in people can use it; for anyone else, use your websites (below).

On your websites (visitors)

When Anyone can talk to it (visitors) is on, the agent's Contained section shows On websites. Add a website chat and fill in:

Switch the chat on when you are ready. You can try it first with Preview on the same page.

Put it on your website. On websites shows two snippets. Use one of them:

• The chat button (one line). Paste it before the closing </body> tag. It adds a round chat button in the corner of your pages:

  <script src="https://<your-server>.crhq.ai/chat/embed.js" data-site="<site key>" async></script>
  

  This script runs on your page with your page's rights, like any script you add.

• A plain frame (no script on your page). For the strictest setup, embed the chat as a frame where you want it:

  <iframe src="https://<your-server>.crhq.ai/chat/<site key>" title="Chat"
          style="width:380px;height:560px;border:1px solid #ddd;border-radius:12px"></iframe>
  

Copy the snippet from On websites: it already contains your server's address and the chat's site key.

What visitors see:

• A short notice that they are talking to an AI assistant and that a person can join.
• A quick human check (Cloudflare Turnstile) whenever they start a new conversation, and again if they send too many messages too fast.
• The conversation itself, and a Talk to a person button.

Talking to a person (websites)

A visitor can press Talk to a person, or the agent can hand the conversation over when it cannot help.

• On websites then shows N waiting for a person for that chat, and lists those conversations first. Open one to read it.
• Reply as a person. The visitor sees your reply under your display name, never your email address. Your reply is not an instruction to the agent.
• While a conversation waits for a person, the agent does not answer. The visitor's messages are kept.
• Hand back to the assistant when you are done. The agent then answers what the visitor asked in the meantime.

Spending caps

Every contained agent has spending caps, checked before each answer is paid for, in all three ways in. When a cap is reached, the person sees a polite message ("We've reached today's limit for this chat"), never a technical error.

A turn with no person behind it (an API key, a schedule) counts per conversation. Contained agents use a small, fast model by default and run on a separate, limited AI account, never on your server's own. On your websites, visitors are also limited in how often they can write (a few messages a minute, a daily maximum) and how many new conversations one network can open per hour.

The off switch

You can stop a contained agent at any moment:

• Turn the agent off (deactivate it) or delete it: new messages are refused straight away, and a reply in progress is stopped at once, in the app and on your websites.
• Switch its Contained setting off: replies in progress stop at once (in the app and on your websites), and its website conversations get no further answers. In the app it then works as a normal agent again, with full power: to stop it entirely, turn it off instead.
• Switch only Anyone can talk to it (visitors) off: the same for its website answers only.

Each website chat also has its own switch in On websites:

• visitors see "This chat is unavailable right now" at once;
• answers that are being written are stopped, and On websites tells you how many;
• nothing the agent produced after the switch is shown to anyone.

Privacy: your duties (websites)

You run the chat on your website, so you decide what happens with visitors' data (you are the controller). CRHQ processes it for you.

• Your privacy notice must cover the chat:
  • that visitors talk to an AI assistant, and that the conversation is processed by an AI model provider (Anthropic) on your behalf to produce the answers;
  • that the human check is run by Cloudflare Turnstile, which receives the visitor's IP address and browser information for the check (CRHQ's central service verifies the result);
  • what is stored and for how long (below);
  • that a person from your team may read and answer the conversation.
• What is stored on your CRHQ server: the conversation (the visitor's messages, the agent's answers and your team's replies), when it happened, and the visitor's network prefix (the first part of the address only). Like any website, the server's web logs also record full IP addresses for a limited time.
• What is stored in the visitor's browser: a small functional cookie and a site storage entry that keep the conversation going. Both are strictly necessary for the chat; neither is used for tracking.
• Retention: conversations are deleted after the number of days you set (default 90).
• Deletion on request: in On websites → Visitors, use Delete conversation. It removes the conversation, what the sealed space kept for it, and the visitor record. The spending records keep only an anonymous visitor id with amounts, never any content (for a team member: their account number, never their email).
• Do not ask visitors for sensitive personal data in the chat.

Conversations of your own team with a contained agent are kept like their other conversations in the app.

Build and rent agents that do one job

If you run CRHQ for clients (agencies, consultants, IT partners), contained agents are a product you can offer: an agent that does one job well, safely, under your brand.

• One server per client, under your brand. With White Label, each client's server carries your brand and your domain. The website chat itself is always served from the server's <server>.crhq.ai address, even when the client's app uses your domain: copy the snippet from On websites and it already has the right address.
• Build the agent with the client's own material. Grant only what its job needs, and for visitors only what the client would publish: their FAQ, product pages, policies. Write its instructions in the client's tone.
• Agree the limits. Set the spending caps to what you charge for, and tell the client how the off switch and the hand-off to their team work.
• Make privacy part of the handover. If the agent is on the client's website, the client's privacy notice must cover the chat (see above); give them the wording.

Typical jobs: a support assistant on the client's website, an internal helper that answers from the client's handbook, a quote or booking helper on a page of their workspace.

Questions and answers

Can someone make the agent reveal our internal information? Only what you gave it. The sealed space keeps everything else out of its reach, so give it only what its job needs, and only public material if visitors may talk to it.

Can a visitor see another visitor's conversation? No. Each conversation belongs to one visitor and one chat.

Can the same agent serve my team and my website? Yes. Turn on Contained and Anyone can talk to it (visitors): your team reaches it in the app and on pages, visitors on your websites. Each conversation runs in the sealed space.

Does the chat work on several of our sites? Yes: list each site under Websites. Each chat can have up to 20.

What if something goes wrong in an answer? The person sees a short, polite message and can try again (visitors can also ask for a person). You can switch a website chat off at any time.