Nexra Agent
Ask about connectors, connections, runs, approvals and policies in plain words. Nexra Agent prepares changes, and a person approves every one before it runs.
Updated 12/10/2026
On this page
What it is
Nexra Agent is the assistant built into the console. Ask it why a run failed, what a connector can do, what is waiting for approval or what a policy would decide, and it answers from your own workspace. When a change would help, it prepares a proposal. A person approves every change before anything happens.
Open Nexra Agent from the sidebar, or press Ctrl + J (⌘ + J on a Mac) anywhere in the console.
What it can look up
Every lookup is scoped to your workspace and checks the same permission as the matching console page, so Nexra Agent only sees what you can see. Answers carry IDs, statuses, counts and safe messages, never credentials or raw provider payloads.
| Ask about | For example |
|---|---|
| Connectors | Search the catalogue by name or category, and describe a connector's operations, risk tiers, sign-in fields and setup steps. |
| Connections | List your connections with their health and last check. |
| Runs | List recent runs, and explain why a run failed: error categories, failed records, dead letters and the next step. |
| Approvals | List approvals waiting for a decision, both governed writes and agent proposals. |
| Policy decisions | Dry-run a write against your policies, or against a draft policy, and get the decision, rule and reason. Nothing is written. |
| Release gates | Show whether a flow's release gate blocks deployment, why, and its last checks run. |
| Templates | Find governed workflow templates from a plain request ("book Flutterwave settlements in NetSuite"), best match first, and describe one: steps, connectors, choices, policies and setup. |
| Workspace records | Obligations due soon or overdue, the customers an asset serves, evidence matrices and statements, with their review status. |
| Governance measures | Writes allowed, held for approval and denied, approval throughput and denials by rule, over 7 or 30 days. |
What it can propose
Nexra Agent cannot change anything itself and cannot approve anything. To change something, it creates a proposal that shows exactly what will happen.
| Proposal | What happens once approved | Who can approve |
|---|---|---|
| Create or update a policy | The policy is saved through the policy editor's own validation, replacing the policy for that scope and operation. | Owner, Admin, Security administrator |
| Install a template | The template's draft flows are installed. Template policies only ever tighten existing ones. | Members who can create integrations |
| Prepare a connection setup | You get a setup checklist and a link to the secure sign-in form. Sign-in details are entered in that form, never in chat. | Members who can create connections |
| Retry a dead-lettered record | The record is retried through the normal retry path, so its write still passes the governed-action gate and any approval it needs. | Members who manage the dead-letter queue |
| Create a developer application | A sandbox application is created. | Owner, Admin, Developer |
| Create a sandbox collection | A sandbox request collection is created for an existing application. | Owner, Admin, Developer |
| Add or change an obligation | The obligation is saved and Nexra reminds its owner before it is due. | Members who manage records |
| Mark an obligation done | The current due date is marked done; a repeating obligation moves to its next due date. | Members who manage records |
| Add customers to the customer map | Up to 200 asset and customer pairs are added to the customer map, or updated if they exist. | Members who manage records |
| Save an evidence matrix | The evidence matrix is saved and sent for a person's review. It never scores, ranks or rejects anyone. | Members who manage records |
| Make a statement | The statement is made and waits for its own approval before anything can send it. | Members who manage records |
A different person approves every change
Each proposal is stored with its exact input, a plain-words summary and a digest of exactly what will run. The proposal card shows Waiting for approval, what happens when you approve, and the digest. If anything in the proposal changes, the digest changes too.
The person who proposed a change cannot approve it. A different authorised workspace member must review it; the proposer can still reject their own proposal.
The permission for a proposal is checked when it is proposed, again when a person approves it and once more when the change is applied.
An approval runs the change once. Repeated or concurrent approvals are refused rather than run twice.
Rejecting a proposal changes nothing.
Proposal, approval, rejection, success and failure are each recorded in the audit log.
Nexra Agent never writes to your connected systems directly. Connector writes happen only through flows and agent credentials, which pass the governed-action gate like any other write.
What it never does
Accept credentials in chat. Sign-in details go into the secure form only.
Approve, execute or decide anything on your behalf.
Change roles or permissions, create API keys or credentials, enable production access, publish an MCP server version or send messages outside Nexra.
Ask company data
Members of a read access group (Settings › Members › Read access groups) can switch Nexra Agent to Ask company data and ask about the business's own data across the systems their group can read: "How much did we collect last week compared with the week before?" Answers are read only and cited: every number points to a read or a calculation Nexra did in code, and a number nothing supports is removed. Personal details are hidden when the group says so, and every question is in the read access log.
Owners and admins set groups up. A group with Insights on Home also shows its members a Leadership section on Home, with who's in today from the source the business chose:
| Source | "In today" means |
|---|---|
| SeamlessHR | Clocked in today, when the business uses SeamlessHR Time and Attendance. Otherwise active employees minus those on leave. |
| Microsoft 365 sign-ins | A successful Microsoft 365 sign-in today. Needs Microsoft Entra ID P1 or P2 and the AuditLog.Read.All permission. |
| Your own system | The people your own system lists for today, from a REST connection or a daily file. |
Home says which one applies. The same questions and the Leadership summary are available in Teams, Copilot, Claude and ChatGPT through MCP, always as the person who signed in.
Privacy
Your messages, API metadata, documentation and request logs are redacted before Nexra Agent reads them, and documentation answers use published pages only. Prompts and answers are not written to logs.
Usage
Each answer draws on your workspace's agent units, shown in the Nexra Agent side panel. Nexra Agent's lookups never count as governed executions (see Workspace usage).
Over the API
| Method | Path | Purpose |
|---|---|---|
GET | /api/console/ai/actions | List proposals in the workspace |
GET | /api/console/ai/actions/:actionId | Read one proposal |
POST | /api/console/ai/actions/:actionId/approve | Approve and apply the proposal once |
POST | /api/console/ai/actions/:actionId/reject | Reject without applying anything |
Proposal responses include requiresIndependentApproval: true and the current viewer's canApprove hint. The approve endpoint returns 403 when the requester is also the proposer, or when the original proposer is unavailable. Role permission is required in addition to a different identity; the server always makes the final decision. Rejecting one's own proposal remains available when the role permits it.