adeelahmad · Oct 6, 2026 · Oct 6, 2026
diff --git a/docs/assistant.md b/docs/assistant.md
@@ -138,7 +138,8 @@ shared with namespaces (admins can share with everyone), and switched on or off
 - **Tool**: something the assistant can call, with typed parameters. Its body is a prompt (`{{param}}` in the text), a
   web request (public addresses only), or a graph drawn on the canvas (`ask_model`, `call_tool` and the primitives,
   from `arg` nodes to `return` nodes), or Python code (admins only, below). A tool with `effect: change` asks for
-  approval before it runs.
+  approval before it runs, and so does another person's tool (unless an admin shared it), since `effect: read` is
+  only its author's word.
 - **Skill**: instructions and a line saying when to use them. The assistant sees the line, and reads the instructions
   only when the skill applies.
 - **Hook**: runs when a question arrives, before or after a tool, or after an answer, to add context, block a tool or

diff --git a/fastapi_backend/app/domain/extensions.py b/fastapi_backend/app/domain/extensions.py
@@ -599,12 +599,15 @@ def __init__(self, db, me):
                     continue
                 if it["kind"] == "tool" and it["spec"]["run"]["type"] == "python" and not _owner_admin(db, g):
                     continue  # code runs only while an admin owns it
+                spec = it["spec"]
+                if it["kind"] == "tool" and not trusted and spec["effect"] == "read":
+                    spec = {**spec, "effect": "change"}  # "read" is its author's word: another person's tool asks first
                 item = {
                     "ext": g["id"],
                     "version": g["version"],
                     "name": it["name"],
                     "description": it.get("description"),
-                    "spec": it["spec"],
+                    "spec": spec,
                 }
                 if it["kind"] == "tool":
                     self.tools.setdefault(it["name"], item)

diff --git a/fastapi_backend/tests/api/test_extensions.py b/fastapi_backend/tests/api/test_extensions.py
@@ -142,6 +142,26 @@ def test_tools_and_skills_in_a_conversation(app, db, cfg, folder, new_client, ll
     assert "use_skill" not in names()
 
 
+def test_another_persons_tools_ask_first(app, db, cfg, folder, new_client):
+    """`effect: read` is its author's word, so a teammate's tool waits for a yes; one's own, or an admin's, doesn't."""
+    s = Assist(app, db, cfg, folder, new_client)
+    c, h = s.cl["editor"]
+    ca, ha = s.cl["admin"]
+    tid = c.post("/api/v1/extensions", headers=h, json={"text": TOOL}).json()["id"]
+    c.patch(f"/api/v1/extensions/{tid}", headers=h, json={"visibility": "namespace", "namespaces": ["pods"]})
+    aid = ca.post("/api/v1/extensions", headers=ha, json={"text": TOOL.replace("translate", "translate_shared")}).json()["id"]
+    ca.patch(f"/api/v1/extensions/{aid}", headers=ha, json={"visibility": "everyone"})
+
+    def effects(email):
+        a = db.one("SELECT record::id(id) AS id, admin FROM account WHERE email = $e", e=email)
+        me = extensions.who(a["id"], email, a.get("admin"), {s.pods: "viewer"})
+        return {n: t["spec"]["effect"] for n, t in extensions.Active(db, me).tools.items()}
+
+    viewer = db.one("SELECT VALUE email FROM account WHERE email != 'ed@x.io' AND admin != true LIMIT 1")
+    assert effects("ed@x.io") == {"translate": "read", "translate_shared": "read"}
+    assert effects(viewer) == {"translate": "change", "translate_shared": "read"}
+
+
 def test_change_tools_ask_first_and_hooks(app, db, cfg, folder, new_client, llm, monkeypatch):
     s = Assist(app, db, cfg, folder, new_client)
     c, h = s.cl["editor"]