Dicey Table
Docs
Search the docs

Stay in control

AI agent safety in DiceyTable

Yes, within clear limits. An AI agent acts as you and nothing more. It sees only what your seat sees, and anything permanent waits for your click.

3 min readVerified

View as Markdown
On this page11 sections

Yes, within clear limits. The agent is you and nothing more: it works through your tab, your sign-in and your seat, and anything you can't easily undo waits for your click in the tab.

Each safeguard below gets a short summary and a link. The page ends with what no web app can enforce. New to agents here? See what an agent can build with you.

Where a tool call is checked A tool call passes five places. Your AI app may ask you first. The bridge keeps local files inside allowed folders and accepts only DiceyTable tabs. Your tab checks the key's permissions, your page and role, and the action class: R reads, W is undoable, D needs confirm: true, H waits for your click. DiceyTable's server checks the key and records the session. At a live table, the host re-checks every move. Your AI app the agent Its own permission prompts, if you turn them on Bridge your computer Folder fence for local files Accepts only diceytable.com tabs Your tab signed in as you Key permissions · your page and role R read · W undoable · D confirm: true H waits for your click DiceyTable server Checks the key, records the session (the AI badge) · guarded URL proxy Host, at a live table Re-checks each move like any other player's A tool call must pass every check before it changes anything.
Every stop checks. A tool call has to pass every check before it changes anything.

The one rule: the agent is you#

The agent has no identity of its own at the table. It uses your tab, your sign-in, your seat, your role and your editor lease. The lease is the lock that lets one tab edit a project at a time. Every change the agent makes goes through the same code a click would.

At a table, the agent never goes around the host. If you are a player, your agent asks the host, and the host checks the request like any other.

What can the agent reach?#

The page you are on and your role there decide what the agent may do.

Page Your role The agent gets
Editor, in the tab that holds the project lease Owner Read and write tools, as far as the key allows
Editor, in a tab without the lease Read-only Read tools only (writes return read-only-lease)
Preview (/table?preview=…) Alone at the table Read, play, and table_step_physics
Live table, as host Host Read, and every action your own screen allows
Live table, as player Player Read, and the moves a player may make; the host checks each one
Live table, as spectator Spectator Read only
Lobby Member or owner Ready, role and deck picks; owners also set the game, options and settings, and start it
/play/settings — session_status only

Hidden information#

At a table, the agent sees only what your seat may see. It never sees another seat's hand, a face-down card, the deck order or the host's private random numbers. That holds even when you are the host, whose browser holds everything. Hidden cards and AI agents explains how, including the camera rules for screenshots.

Action classes#

Every tool has a class that says how careful the tab must be. R reads, W makes a change you can undo, D deletes something a restore point can bring back, and H always waits for your click. X covers things like your account and billing, and no tool for them exists at all. No key permission removes an H confirmation. Actions that need your click lists every one.

Watching and stopping it#

While an agent is connected, the tab shows an Agent connected chip. Its menu can pause the agent, disconnect it, or list every call it made. See Watch, pause or stop your agent. To switch agents off for good, see Disconnect, revoke or remove the agent.

Other players see an AI badge next to your name while your agent is connected. The AI badge page explains why it can't be faked.

Your files and the web#

The bridge reads local files only inside folders you allow, and it refuses secrets like .env files. See which local files an agent can read.

There is no general "fetch any web page" tool. The one thing that downloads is an asset import from an https:// address, and DiceyTable's server fetches it under strict rules. See how URL imports are fetched safely.

Text that tries to trick the agent#

An agent reads text other people wrote: card text, chat, mod rules, file names. Some of it may try to give the agent orders. This is called prompt injection. Tools mark that text as untrusted, and the rules above cap the harm even if the agent is fooled. See prompt injection protection.

Privacy and the relay#

On a direct connection, tool traffic stays on your computer, between the bridge and your tab. If your browser can't reach the bridge, traffic goes through DiceyTable's relay instead. The relay passes it along without storing or logging it. See what leaves your computer.

Keys and scripts follow the usual rules#

Keys work only on DiceyTable's agent endpoints. They expire, you can revoke them at once, and our server keeps only a hash of each one. A hash is a fingerprint that can check a key but can't be turned back into it. See create an API key.

A script the agent writes goes through the same compiler and safety scanner as yours. Agent tools never reach into a mod's sandbox. See write game scripts with an agent.

What cannot be enforced?#

Here are the honest limits.

Threat Enforced? Why
Someone forges an AI badge onto another player Yes The badge comes from the server's own record of that player's agent sessions.
Someone hides our bridge's agent from other players Yes, for our bridge Tools work only after the server records the connection, and that record is the badge.
Someone drives DiceyTable with their own tools, like an automation script or a modified client No To our servers that looks like a person. We do not try to detect it.
Someone modifies both the client and the bridge to hide agent time and earn chips Partly The server checks the bridge's heartbeats, the tab's heartbeats and the connect records. Beating that takes changing both, which is the row above.
A key leaks Contained It works only on the agent endpoints and needs a tab you pair. It can use up its URL-import allowance until you revoke it.
A program on your computer pretends to be the bridge Contained It would need your key and a pairing code you type. Malware running as you, on your computer, is beyond what any web app can defend against.
A harmful website tries to reach the bridge Blocked The bridge listens only on your own computer and accepts only an exact list of web addresses, DiceyTable's own by default. Pairing also needs your code and your DiceyTable sign-in.
Card text, chat, mod content or a fetched file tries to steer the agent Reduced It is marked untrusted, and the harm is capped by the rules above.

Did this page answer your question?