---
title: Agents and versions
description: Create an agent and publish its versions.
---

An **agent** is what a workspace runs. It holds no configuration of its own: it is a name, and a line of **versions**. Each version names the model a session runs, what the model is told, and the tools it may reach.

A session runs the version that was latest when it started, from start to end. Publishing a new version changes only the sessions started after it — which is what makes publishing safe while people are mid-conversation.

## Creating an agent

**Agents** › **New agent** asks only for a name: how the people and the code using the workspace tell the agent apart.

![The New agent dialog](/blume-assets/content/docs/_images/en/agent-new.webp)

The agent starts with no version, and no session can start on it until its first one is published. **Publish first version** opens the version editor.

## The version editor

The editor is one form, top to bottom. Publishing checks it as a whole: a field that needs fixing is marked, and nothing is published until every one is right.

### Provider and model

![Provider and model](/blume-assets/content/docs/_images/en/agent-editor-model.webp)

| Field | What it sets |
| --- | --- |
| **Provider** | Where the model runs: one the platform offers, or one of the workspace's own. See [Model providers](/console/model-providers). |
| **Model** | A priced model of a platform provider, or the model's ID as your own provider's API takes it. |
| **Output limit** | The most tokens the model may write in one step. |
| **Context window** | How many tokens the model reads at once. |
| **Reads images** | Whether the model is shown images: from a function's result, say. |
| **Thinking**, **Thinking budget**, **Effort** | Anthropic models: whether and how much the model thinks before answering. |
| **Reasoning effort** | OpenAI Responses models: how hard the model reasons. |

### Instructions

![Instructions](/blume-assets/content/docs/_images/en/agent-editor-instructions.webp)

The **System prompt** is what the model is told before every conversation. Leave it empty to tell it nothing.

### Tools

**Tools** is what the agent may reach. Every tool runs under a **policy**:

| Policy | When the agent calls the tool |
| --- | --- |
| **Allow** | It runs. |
| **Ask first** | It waits until a person allows or denies it, from the console or from your app. See [Approvals and forms](/build/approvals-and-forms). |
| **Deny** | It is refused. |

Each grant has a **Default policy**, which covers every tool it offers, including one its source adds later, and **Tool rules** that override it for a tool by its exact name.

#### MCP servers

![An MCP server grant: name orders, its URL, and Ask first as the default policy](/blume-assets/content/docs/_images/en/agent-editor-mcp.webp)

An MCP server is named, for the model, and pointed at by its URL. The version holds no credential: a session signs in to the server with the credential its [vaults](/console/vaults) hold for that exact URL.

#### Skills

![A skill grant: the refund-policy skill, following its latest version](/blume-assets/content/docs/_images/en/agent-editor-skill.webp)

A [skill](/console/skills) is instructions and files the agent reads when it needs them. **Latest** reads whichever version is newest when a session starts; **Pinned** stays on one version for good.

#### Sandboxes

A [sandbox](/sandboxes) is a Linux machine each session gets of its own, with a tool that runs commands on it. **Release** is the platform image line it boots, which pins its toolchain, and **Network** says whether it reaches the internet. Grant one only for programs that need Linux — building a codebase, a native CLI — and give the agent [functions](/functions) for everything else: they are safer, cheaper, and keep credentials out of the model's reach. [Sandboxes](/sandboxes#start-with-a-function) compares the two.

#### Function packages

![A function package grant: the workspace's anydoc package pinned to version 1, with a timeout, network, and credentials](/blume-assets/content/docs/_images/en/agent-editor-functions.webp)

[Subako Functions](/functions) are WebAssembly packages the agent calls as tools: the platform's own, or ones this workspace uploaded. A grant also sets how long one call may run, which hosts it may reach, and which origins get a credential from the session's vaults. [Granting functions](/functions/granting) covers every field.

#### Names the session and Asks people

**Names the session** says whether the agent may title its session: never, only while it has none, or until a person renames it. It never overwrites a name a person wrote.

**Asks people** lets the agent put a form to a person when it needs a decision: a pick among options, free text, or yes or no, plus **Custom widgets** your own app draws. See [Approvals and forms](/build/approvals-and-forms).

### Session Volume

![Session Volume: Give functions Data (/volume/data), switched on](/blume-assets/content/docs/_images/en/agent-editor-volume.webp)

Functions read and write files in the session's **Session Volume**. **Temporary** (`/volume/tmp`) is always there and is cleared 24 hours after the session's last activity. **Give functions Data (/volume/data)** adds a second area whose files are kept until the session is deleted.

## After publishing

**Publish version N** returns to the agent's page, which shows the version as it was published.

![The agent's page: version 1's model, instructions, and tools](/blume-assets/content/docs/_images/en/agent-page.webp)

- **Version** picks any earlier version to read; versions are kept for good.
- **Publish new version** opens the editor filled in from the version shown, so a change starts from what is there.
- **See this agent's sessions** lists the sessions that ran it.
- **CORS** lists the origins a browser may call this agent's sessions from. A server-side client sends no `Origin` and needs none; a page that talks to a session directly, with a [session token](/build/sessions-api#session-tokens), needs its origin here.
- **Agent actions** copies the agent's ID, renames it, or deletes it — with every version and every session that ran one. Usage already recorded stays.

The same version can be published from a file, too: the editor's form is the agent config document that [`subako agent publish`](/build/cli#agents) and the API take, described field by field in the [agent config reference](/reference/agent-config).