An open-source AI teammate keeps its permissions in your repo

A vendor that sells its product as a colleague promises three things at once. The agent holds a role, it shares your context, and it knows where its authority stops. DevRev's explainer is explicit about the third: an AI teammate solves problems "always with a human in the loop for oversight on the decisions that really matter" (DevRev).

Read those three promises together and a fourth question appears. Who holds the list that decides which decisions matter?

A demo skips that question. It shows the summary written, the ticket triaged, the reply drafted. It rarely shows the screen where someone grants the agent the right to send that reply, or the person who decides it may not close the ticket afterwards. That screen is the product.

Teammates.ai, Asana and Teamwork each put the teammate inside software they control, so the edge of that software becomes the edge of its authority. Asana states the arrangement plainly. A teammate can search, read and write across "10+ connected apps", and you choose its project access "using your existing permissions" (Asana). That is a sensible boundary for work that already lives in Asana.

It is still Asana's boundary. The list of what the teammate may touch is administered from Asana's settings, by the people Asana gives that screen to. When the teammate needs something outside, a contract in the finance drive, an offer letter in the HR system, an invoice in billing, the request leaves the product and takes the permission model with it. What remains is a login: one seat inside one surface.

Teamwork draws the same edge. Scout reads tasks and meetings, Flow reads project health, and Dotty reads support inboxes, all inside Teamwork.com (Teamwork). The page names each role and says the team is growing. It publishes nothing about how far each one may reach.

Kortix keeps the teammate as a folder in a git repo your company owns, and the manifest points at it.

1# kortix.yaml2agents:3  support-triage:4    file: agents/support-triage.md   # what it does, in plain markdown5    connectors: all                  # what it may reach

That block declares the role and its reach. The markdown file beside it holds the instructions. Company memory, connector configuration and triggers follow the same pattern, so a reviewer opens all four without a login. Open source. Read it, fork it, audit it. The change that widens a role's reach arrives as a diff somebody on the team approves.

The permission layer is where the argument stops being philosophical. Set each tool to Allow, Ask or Block, down to the arguments of each call. An Ask holds the call until a person approves it, then the agent resumes. Approval gates you set. Off until you set them.

The moment that matters is the one the demo skipped. The teammate needs a permission only your team can grant, because only your team knows whether this refund, this contract, this candidate is the one that breaks a rule. In this setup the grant is a line in a file your team reviews. No vendor ticket sits between the request and the answer, and the person who says yes works where the work happens.

Teammates.ai sells the shortest path in this group. Raya handles customer service, Adam handles sales, Sara handles recruiting, and three employees come from $25 a month with a free plan behind them. You connect tools over OAuth (Salesforce, HubSpot, Zendesk and 50+ more), upload documents to set the brand voice, and the page puts setup under five minutes. It also advertises 50+ languages.

For a small team that wants those three functions running this week, with nobody on staff to run software, that is a fair trade. The trade is visible on the same page. The roster is fixed at three, the learning happens on Teammates.ai's platform, and no approval model is published. A boundary exists there. You cannot read it before you trust it.

Asana ships 30+ prebuilt teammates and a no-code builder for your own, with skills, human review checkpoints, scoped permissions, spend controls and an audit trail (Asana). If your projects, portfolios and status reports already run in Asana, a teammate inherits the context that makes those workflows legible. It arrives on the paid plans and not on the free Personal plan.

Teamwork takes a narrower run at the same idea. Scout, Flow and Dotty cover productivity, project management and support inboxes inside Teamwork.com. A services team already tracking client work there gets a teammate with the data in front of it, which is most of what makes the first week useful.

Both are closed products, and neither publishes a self-hosting option, so the boundary stays theirs. That suits a company that has decided its system of record is the vendor's product.

The same repo answers the exit question. Company memory sits in it, next to the role that reads it, so a new model reads what the old one was told. The same files run on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free.

The question worth carrying into a trial is smaller than a feature comparison. Ask who can grant the teammate its next permission, and how long that takes. A product that answers with an admin screen is selling access to a role. A product that answers with a file, a diff and a reviewer is handing over the role itself.