Agent platform

Tasker treats AI assistants as workers you hire, not as features that act on their own. The product stays at three ideas: hand a task to an assistant, it asks before anything risky, and it leaves receipts. In the app the metaphors are assistants you hire and keys you hand out; words like MCP, token and elicitation never appear in the interface.

The entities

Entity	What it is
AgentProfile	An assistant: where its model runs, its trust level and per-capability overrides, budgets, quiet hours, pause flag and key digest
AgentRun	One piece of delegated work, with a status that mirrors the MCP Tasks extension
ApprovalRequest	The pause point: one plain sentence for you, plus a machine payload
AgentEvent	An append-only receipt, with an optional undo
AgentAutomation	A scheduled delegation, such as “every Sunday at 5 PM, plan my week”

An assistant’s model can run on this device, in the cloud with your key, on a nearby paired device, or in any MCP client holding a key you issued.

A run moves through queued, working, input_required and then one of completed, failed or cancelled. The status names match the MCP Tasks extension exactly, so a run round-trips as an MCP task with no translation table.

The trust ladder

Trust is granted per capability, never wholesale:

Level	Meaning
Paused (0)	Nothing executes, anywhere
Suggest only (1)	Reads and proposes; every idea arrives as a draft or a card
Ask first (2)	Acts, but each action waits for your OK
Trusted (3)	Acts within its budgets; deleting still asks

Capabilities are read your tasks, add tasks, check things off, move dates, delete things, write pages, run on a schedule, and other changes. Every new assistant starts at suggest only. Promotion is always a human act: tapping “Always allow” on an approval card promotes exactly one capability for that assistant. A tool the platform does not recognise is classified as “other changes”, so an unknown action fails safe.

One gate, three outcomes

Every action an assistant attempts passes through AgentGate, and there are exactly three outcomes: allowed, needs approval or refused with a reason. There is no fourth path, which is what keeps the system auditable. The checks run in order, and the first hit wins:

1. Pause. The red pause-all switch, or this assistant’s own pause, refuses everything.
2. Reads pass. Reading is always fine once nothing is paused.
3. Quiet hours. A daily do-not-disturb window, which can wrap past midnight, refuses changes.
4. Budgets. Actions per run and tokens per day; zero means unlimited.
5. Trust. Suggest only and ask first need approval; trusted is allowed, except deletion, which always asks.

The gate is pure and synchronous: it takes no store and reads no clock, so the whole decision matrix is unit tested. Refusals come back as plain sentences that both the assistant and your receipts show, such as “It’s quiet hours. Nothing was changed.”

Approvals

When the gate says “needs approval”, Tasker creates an approval card with one sentence describing the change, and the run moves to “Needs your OK”.

• Approvals are one-shot tickets keyed to the exact tool and arguments. Retrying the approved call executes it exactly once and consumes the ticket. A denied call reports back without running. A different call gets its own card.
• The same approval can be answered in Tasker’s Approvals tray, on Apple Watch, or by the MCP client as an elicitation. The first answer wins.

Receipts and undo

Every gated step writes an AgentEvent: narration, an action, a gate decision or an error, each as a plain sentence. Receipts are append-only and they are the audit trail.

An action receipt can carry an undo, recorded at the moment the action ran. Additions and completions undo cleanly today: undoing a created task, project, page or space removes it, and undoing a completion reopens the task. Undo is one-shot and leaves its own receipt, so the trail reads “Scout added a task”, then “You undid: Scout added a task.” Undo for reschedules and deferrals needs the earlier value captured first and is planned.

Scheduled delegation

An automation is a run that starts itself: pick an assistant, a task and a schedule (every day, weekdays, weekly or monthly). When it fires, it creates an ordinary run through the ordinary facade, so trust, budgets, quiet hours, pause and receipts apply exactly as they do to work you hand over yourself. There is no second permission system.

Missed slots are caught up safely, and a slot that fires while assistants are paused is consumed rather than queued, so unpausing does not unleash a backlog.

Pause-all

One red switch freezes every assistant. It also flips each assistant’s synced pause flag, so pausing on your iPhone stops work on your Mac. When two devices disagree, a pause always sticks.

Keys

An assistant outside the app, such as Claude Desktop, gets a house key:

• issueKey mints tk_ followed by 32 random bytes (about 256 bits) in base64url, shows it once, and stores only its SHA-256 digest.
• The key’s powers are not in the key. They live on the assistant’s profile, so you can promote, demote or pause an assistant at any time without issuing a new key.
• Revoking is one write. The next request with the old key is refused.
• Keys never leave the device that minted them: backups and imports leave the digest out, so a restored assistant starts without a key.

See MCP server for how a key is used.