The Fleet Agent and Your Organization's Conversations

Overview

If your servers belong to an organization, the Fleet Agent on the organization's main server can work with the conversations on the organization's other servers. Anyone signed in to the main server asks the Fleet Agent in plain words, for example: "What is Clerk on the sales server working on? If it is stuck on the invoice export, tell it to use the March file."

People signed in to the organization's main server can read and instruct every conversation on the organization's servers. Each server's people see every such access in Settings > Organization access.

What the Fleet Agent Can Do

On any of the organization's other servers, the Fleet Agent can:

• List conversations: who they are with, their titles, whether they are running, who started them and when they were last active.
• Read a conversation: the people's and the agent's messages. Tool output and attached files are not shared.
• Start a conversation with an agent on that server.
• Send a message into any conversation, also a person's own. If the agent there is busy, the message waits for its turn.
• Interrupt urgently: stop the running answer and deliver the message at once.
• Stop a running answer.

It cannot delete conversations, and it cannot read files or tool output.

Who Can Use It

• Only the Fleet Agent on the organization's main server, and only when a person signed in to the main server asks it in their own message. Every role on the main server can use it.
• Only on the organization's own servers. crhq.ai checks every request.
• There is no extra setting to turn on: it works wherever the organization uses the Fleet Agent and Fleet Actions.

What People on the Other Server See

• Every access is listed in Settings > Organization access: when it happened, which conversation, what was done (list, read, message, urgent interrupt, stop), from which main server and who asked. The list shows what was done. It does not include the words.
• Messages are marked. Every message from the Fleet Agent starts with a line written by the platform, such as "Message from the Fleet Agent on main-server, asked by Jane Smith". Nobody can imitate this line.
• No borrowed rights. An answer started by a Fleet Agent message has no person's rights on that server: it cannot change organization settings, share themes, run Fleet Actions or reveal credentials. The next message the person writes themselves is theirs again.
• A person's stop is respected. If a person stopped their conversation, a message from the Fleet Agent waits until they continue it, and an urgent interrupt is refused.

Passwords and Keys

Before any text leaves a server, passwords and keys found in it are replaced with [REDACTED]. This covers the server's own secret values, common key and token formats (for example GitHub, Slack, Stripe, Google, OpenAI and Anthropic keys, and private keys) and typed passwords such as "password: ...".

This safeguard cannot catch every password or key. Save them in Settings > Credentials instead of pasting them into conversations.

Safety Checks on the Main Server

• Confirmation code. Once the Fleet Agent has listed or read conversations on another server, nothing it changes from that conversation runs at once: no message, start, interrupt or stop. It shows the person a short code, and the platform shows the held change exactly as it will run (the full message, the server and the conversation) under Fleet actions in this conversation. Compare it with what the agent told you before you type the code. The change runs only when that person's own next message contains that code, within 10 minutes. So text read on another server can never make the Fleet Agent act by itself.
• The platform's own record. The Fleet Agent conversation shows Fleet actions in this conversation: every list, read, message, interrupt and stop, with its result, recorded by the platform itself.
• Fixed limits. Per organization and hour: 20 new conversations, 60 messages (10 into one conversation) and 10 urgent interrupts. Each conversation gets at most 3 urgent interrupts an hour, and at most one every 10 minutes from the same person.

What crhq.ai Keeps

crhq.ai checks and records every access: who asked, which server, which conversation, the action and its result. It does not store the text of conversations. A list or read answer is passed to the main server once and then dropped. For a message the Fleet Agent sends, crhq.ai keeps only its length and a fingerprint that is keyed to your organization.

Reading the Record by API

A server's own people and its master key can read the same list as Settings > Organization access:

GET /api/settings/org-access?limit=200&since=2026-10-01T00:00:00Z

API keys made for products cannot read it, and no route edits or deletes it.

Frequently Asked Questions

Is a person's conversation private from the organization? No. People signed in to the organization's main server can read and instruct every conversation on the organization's servers. Each access is listed in Settings > Organization access on that server.

Can I turn it off for one server? No. It works on every server of the organization. A server that should not be reachable this way should not be part of the organization.

Can the Fleet Agent see files or what tools printed? No. Only the people's and the agents' messages and conversation titles.