# What an Agent Channel Chat Can Reach

A chat created through an [Agent Channel](/products/ai-studio/agent-channels/) is an ordinary Treasure AI Studio chat with two things changed: its workspace is disposable and holds one shared work folder read-only, and the only instructions reachable from outside are "send this prompt" and "stop". Everything else — the model, the tools, the connections, the credits — is the executor's, exactly as if they had started the chat themselves.

Read this page before you open a channel to an application whose users you do not control. It states both halves of the boundary: what a channel chat is prevented from doing, and what it is **not** prevented from doing.

## The Workspace Is One Folder, Read-Only, and Disposable

A channel chat works inside the SDK App's shared work folder. The agent can read every file in it and cannot change any of them. Alongside it, the chat gets a writable scratch area for the files it produces while working.

| What  | In a Channel Chat  |
|  --- | --- |
| **The shared work folder** | Readable, never writable. Files that members put there through Treasure AI Studio are visible to the agent; nothing the agent does changes them |
| **Scratch space** | A writable area inside the chat's workspace, created with the chat and deleted when the chat is purged. Nothing written there survives into the next chat |
| **The executor's other work folders** | Out of reach. A channel chat reaches one folder and only one |
| **The executor's personal settings and history** | Out of reach. The executor's own configuration, saved memory, and the transcripts of their Studio chats are not present in the workspace |
| **Account-managed configuration** | Readable — the account's own settings and its installed plugins load as they do in any chat |


The practical consequence is that a channel chat has no memory between conversations. Each one starts from the folder's current contents, and anything worth keeping has to come back through the conversation itself. If your application needs continuity across sessions, keep it on your side — you already store the chat id and its Chat Access Token, and [resuming an existing chat](/products/ai-studio/agent-channels/building-an-app#showing-a-conversation-the-client-does-not-have) is how the same conversation carries on.

## What Your Application Can Send

The Agent Gateway publishes a deliberately small input vocabulary. Two operations reach the agent:

- **A prompt** — one user message, which starts a turn.
- **A stop** — ends the turn that is running.


Treasure AI Studio's internal chat protocol has more verbs than that: restarting or rewinding a session, changing a session's options such as the model, and adding or installing plugins. None of them is reachable through a channel. They are not blocked by a check that could be misconfigured; they have no representation in the protocol the gateway speaks, so an end user of your application cannot send one.

One more input exists, and it is an answer rather than an instruction: when the agent stops to ask the user a question, your application sends the answer back as a tool result. [Answering the agent's question](/products/ai-studio/agent-channels/building-an-app#the-one-tool-you-have-to-implement) covers it.

## What Your Application Receives

The gateway forwards a named set of events and drops everything else, including anything new that appears in the internal protocol later.

Your client receives:

- The assistant's text, streamed.
- The agent's reasoning, streamed.
- Tool calls — the tool's name and its arguments.
- Questions the agent asks the user.
- The end of a turn, including a failure.


Two things it does not receive, and both shape how you write the client:

- **Tool output.** Your client sees that a tool ran and with what arguments, never what it returned.
- **The reason a turn failed.** A failure arrives as one of a fixed set of categories in fixed text, and the reason behind it stays inside the platform. Design your error handling around "the turn failed", not around parsing the message.


Tool calls also arrive already executed, so your client displays them and nothing needs implementing behind them.

## What Is Not Restricted

A channel chat runs with the **executor's full capabilities**. There is no per-channel setting that narrows them, and this is the part most worth reading twice before you point a public application at a channel.

- **Tools.** The agent has the same tools it has in a normal chat, including running queries and executing code in its sandbox.
- **Connections and credentials.** Every [connection](/products/ai-studio/connections/) the executor has configured is available to the chat, with the executor's credentials.
- **Plugins and skills.** The account's installed plugins and the folder's skills and actions load normally.
- **Model.** The chat uses the account's configured model tier. Your application cannot choose one, and neither can you pin one per channel.


So an Agent Channel contains the workspace and the set of operations reachable from outside — it does not sandbox what the agent itself can do. Treat a channel as granting its callers the executor's reach over the channel's folder, and choose the executor accordingly: a user whose connections and permissions you are comfortable exposing to whoever can reach your application.

Two things follow for anyone deploying one:

- **Prompts arriving through a channel are untrusted input.** They come from your application's users, and they reach an agent that holds real credentials. Apply whatever review your own product needs before forwarding a prompt, and see the [security overview](/products/ai-studio/security/) for how Treasure AI Studio handles prompts and data generally.
- **Scope the executor's access, not the channel.** Because the channel cannot narrow the executor, the only lever is which user the executor is. The fewer connections the executor has, the less the channel can reach.


## Credits, Attribution, and Audit

Everything a channel chat does is attributed to the **executor**:

| Dimension  | Attributed To  |
|  --- | --- |
| **Credits and quota** | The executor. Channel chats draw on the executor's usage the same way their own chats do — see [Credit Usage](/products/ai-studio/credits/credit-usage) |
| **Permissions** | The executor's, evaluated per request. If the executor loses their assignment on the folder, the channel stops accepting connections |
| **Chat ownership** | The executor. The chats appear in the executor's own chat list, labelled **SDK App** and marked with a key on the chat icon |
| **Data retention** | The account's normal chat retention policy — see [Chat Data Retention](/products/ai-studio/security/data-retention) |


Recent Chats in the sidebar showing a chat labelled SDK App above its title, with a small key on the chat icon
Which end user of your application triggered a given chat is not something Treasure AI Studio records, because it has no identity for them. If you need that link for your own audit, store it against the chat id on your side when you create the chat.

## Limits

| Limit  | Default  |
|  --- | --- |
| **Chat creation** | 30 chats per minute, per SDK App. Counted across all of the channel's tokens, so rotating a token does not raise it |
| **Turns** | 120 per minute, per chat |
| **Concurrent turns in one chat** | One. A chat runs a single turn at a time |
| **Chat Access Token idle lifetime** | 24 hours without use, extended by activity |
| **Chat Access Token absolute lifetime** | 30 days from issue, whatever the activity |
| **Turn duration** | One hour as a backstop. In practice a turn ends well before that |
| **Request body** | 32 MB per request to the messaging endpoint; a single message is capped at 1 MB |


Exceeding a rate limit answers `429` with a `Retry-After` header. The two token lifetimes can be set per SDK App; the others are platform-wide.

## What Happens When a Channel Stops

Disabling an SDK App, revoking its Gateway Token, resigning as executor, or deleting the channel all stop new activity immediately — the next request with any of the channel's credentials is refused.

Chats that already exist are not deleted. They remain in the executor's chat list and fall under normal chat retention. A conversation in progress loses its connection, because the Chat Access Token it was using stops validating; the turn the agent was running is not cancelled by that, so anything it was in the middle of finishes on the server. [Gateway Tokens and Chat Access Tokens](/products/ai-studio/agent-channels/tokens#revoking-a-token) covers which action stops what.

## Next Steps

- [Creating and Managing an SDK App](/products/ai-studio/agent-channels/sdk-apps) — set up a channel and choose its executor.
- [Gateway Tokens and Chat Access Tokens](/products/ai-studio/agent-channels/tokens) — the credentials and their lifetimes.
- [Building a Chat App with the Vercel AI SDK](/products/ai-studio/agent-channels/building-an-app) — write the application that drives the chats.
- [Security Overview](/products/ai-studio/security/) — how Treasure AI Studio isolates and handles data generally.