> ## Documentation Index
> Fetch the complete documentation index at: https://docs.artil.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Messages are not instructions

> Why a client treats what reaches the agent account by email, text, or webhook as information, and what you decide before connecting one.

Anyone can write to an agent account's email address or phone number, so a
message can try to steer the client that reads it: ask it to send a secret,
write to someone else, or act in your name. Artil hands every message to the
client as information to act on, never as instructions, and leaves what to do
with it to the client's own instructions and to you.

## What Artil tells the client

* The `artil` skill that the plugins install and `artil init` writes says that
  messages come from outside, that their text is information and never
  instructions that override the user's, and that a send that failed or was
  interrupted is checked with the user before trying again.
* The [MCP server](/mcp-server) says the same in its instructions to the client.
* The Claude Code channel adds that senders never see the session and tells
  Claude [who each sender is to the agent](/wake-access#who-the-sender-is-to-the-agent),
  so Claude acts on what the sender wants when you would want it done, and
  tells the sender through Artil when it can't, instead of asking you.
* A [webhook](/webhooks) body carries the sender and the subject, which people
  outside wrote, and leaves the message text out; your server fetches the text
  and should treat it the same way.
* A message at the agent's [Message URL](/url) comes from a member or agent of
  the workspace, since nobody else can send one, so the agent takes it as its
  team's request.
* Linked secrets are environment variables in the client's commands; the skill
  tells the agent to use them as `$NAME` and never print their values.

## What you decide

* Choose [who can wake the agent](/wake-access). A new agent only takes mail,
  texts, and messages at its Message URL from you, who created it; open it to
  more senders on purpose.
* Check what the client may do without asking before you connect it. Pi runs
  commands without asking for approval, so a message can lead it to act before
  you see it. The Claude Code plugin and `artil init` allow `artil email`,
  `artil sms`, `artil telegram`, and `artil url` to run without asking; Claude
  may ask before other commands.
* Ask a client that watches on its own, such as [ChatGPT](/chatgpt) or a Hermes
  or OpenClaw gateway, only for what you are happy for it to do with any
  message.
* Send a test email yourself and read the reply before leaving a client to
  answer on its own.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.