# What each area opens

> Every capability toggle, the tier it belongs to, its default, and the tools it advertises.

Each toggle below gates one group of tools. The defaults follow the
[tiers](agent#capability-tiers): reading and configuring are open once the master switch
is on, everything that reaches live equipment is a deliberate opt-in. A disabled area's
tools are not advertised at all, so an agent connected to this station sees exactly the
list you allowed.

## Allowed areas {#allowed-areas}

| Toggle | Tier | Default | Tools it advertises |
| --- | --- | --- | --- |
| Connector (read) | Read | on | `connector_browse`, `tag_read`, `server_status`, `modbus_server_status`, `station_broker_status`, `mqtt_publish_list`, `remote_access_devices` |
| Connector (configure) | Configure | on | `driver_capabilities`, `serial_line_list`, `serial_line_upsert`, `serial_line_delete`, `mqtt_broker_list`, `mqtt_broker_upsert`, `mqtt_broker_delete`, `mqtt_publish_upsert`, `mqtt_publish_delete`, `device_upsert`, `device_delete`, `tag_upsert`, `tag_delete`, `server_start`, `server_stop`, `server_restart`, `server_list_upsert`, `server_list_delete`, `modbus_server_configure`, `modbus_map_upsert`, `modbus_map_delete`, `station_broker_configure`, `remote_access_device_update` |
| Connector (operate) | Operate | off | `connector_refresh`, `device_discover` |
| Logic (read) | Read | on | `logic_browse`, `logic_read` |
| Logic (configure) | Configure | on | `variable_upsert`, `variable_delete`, `action_upsert`, `action_delete`, `trigger_upsert`, `trigger_delete`, `alarm_upsert`, `alarm_delete`, `logic_folder_upsert`, `logic_folder_delete` |
| Logic (operate) | Operate | off | `variable_write`, `tag_write`, `action_run`, `alarm_ack`, `alarm_ack_all` |
| Logs (read) | Read | on | `logs_read`, `event_history_read` |
| Dashboard (configure) | Configure | on | `dashboard_list`, `dashboard_upsert`, `dashboard_delete`, `component_upsert`, `component_delete`, `connection_upsert`, `connection_delete` |
| Process (read) | Read | on | `process_models`, `process_runs`, `process_run`, `process_samples`, `unit_status` |
| Process (configure) | Configure | off | `process_view_configure` |
| Process (operate) | Operate | off | `process_snapshot`, `process_evaluate`, `process_recipe_apply`, `process_start`, `process_stop`, `process_hold`, `process_resume`, `process_abort`, `process_comment`, `process_report`, `process_run_delete` |
| UI (automate) | Operate | off | `ui_state`, `ui_navigate`, `ui_screenshot`, `ui_scroll`, `ui_set_theme`, `ui_resize`, `ui_click`, `ui_set_text`, `ui_select` |
| Backups (manage) | Configure | on | `backup_create`, `backup_list` |
| Backups (restore) | Restore | off | `backup_restore` |
| Settings (manage) | Configure | off | `settings_read`, `localization_set`, `asset_list`, `asset_import`, `symbol_validate`, `symbol_import` |
| Reports (draft) | Read | on | `report_draft` |

Connector (configure) reaches beyond the station itself: an agent that turns the [Modbus server](connector-modbus-server) on with `modbus_server_configure` lets any machine on the network read what its register map serves and write the rows that allow writing. The Agent page says so under the toggle.

Reports (draft) is in the Read tier and on by default, on a station that existed before it as well, because it changes nothing at the station and sends nothing: `report_draft` opens the [report form](account-feedback#a-report-drafted-by-an-agent) at the station filled in, and only the person there sends it.

Two tools are in no area: `help_search` and `help_read`, which read the app's own
documentation for the installed version. No toggle gates them; they are advertised whenever
the master switch is on, because they show nothing of the station. They are described under
[Help](agent-tools#help).

What each of those tools actually does, with the arguments it takes and what it refuses,
is [the tool reference](agent-tools).