Limits, safety and permissions
Things only a person does
| Action | Where the person goes | What a tool answers |
|---|---|---|
| First publish of a function; any widening publish (a new capability, model, query, audience, exposure, a bigger size or a doubled time limit) | .../apps/functions/<name>?publish=v<n> | "A person must confirm this in Studio before v |
| Gated workflow publish (a new or changed send, its approval, a new query or model or "Use", AI text under automatic approval) | the workflow's page | human_publish_required or gated_change_needs_person |
| Expose a function or workflow to agents, chat or MCP | the function's or workflow's settings | person_required |
| Approve or reject a send | Studio → Approvals | never a tool |
| "Send on success" for a workflow | the workflow's settings | person_required |
| An app version that adds or re-pins a function or workflow import | the app's page, at publish | a review link |
| The workspace mail policy and action policy ("may run on its own") | a workspace admin, in Studio | read-only for everyone else |
| Per-workspace agent caps (runs at a time, runs a day) | Bicycle staff | read-only |
A coding agent never tries to get around these. It gives the link, says what will change, and waits.
Sends (workflows)
- At most 50 recipients a step;
max_sends_per_rundefaults to 1, at most 500; 500 recipients per workspace per day (UTC). - An approval waits at most 14 days.
- A send key that was sent is never sent again.
- Sends through connected actions (Slack, PagerDuty, Jira, webhooks) need a person unless a workspace admin allowed that action to run on its own. Never test an action that pages or tickets real people.
- On a preview environment, mail goes only to addresses on the deployment's allowlist.
- A failed screenshot sends nothing; there is no stale fallback.
Cost and time
| What | Limit |
|---|---|
Ask AI step in a workflow (max_cost_usd) | at most $25; a run estimated over $25 is refused (cost_cap) |
| A Code function's Ask AI capability | at most 50 calls and $5 per run |
| A Code function's time limit | 30 s when called synchronously; 15 minutes on the normal path; longer runs take the job path (workflows only) |
| A workflow function step | 15 minutes by default; a screenshot 240 s |
| An agent | default 30 steps, 80 tool calls, $2, 10 minutes; ceiling 100 / 300 / $10 / 30 minutes |
| Detect and Explain | a daily budget per workspace; up to 4 dimensions and 8 filters; 30 minutes a run |
| Functions calling functions | at most 3 levels deep |
| Agents starting agents | at most 3 levels deep |
Sizes
| What | Limit |
|---|---|
| App manifest | 32 queries, 16 imports, 16 analyses, 8 declared agents, 16 blobs, 20 tabs |
| A declared query | SQL up to 8000 characters, 16 parameters, 64 columns, maxLimit up to 10000 rows |
| App bundle | 25 MiB zip; each asset up to 2 MiB |
| A function's input from an app | keep under 64 KB of JSON |
| A function exposed to MCP | schema up to 8 KiB, 16 top-level properties, depth 4; description up to 1000 characters |
| A function name | lowercase letters, digits and underscores, up to 56 characters (so the tool name fn_<name> fits in 64) |
| A workflow | workflow.json up to 256 KiB, a bundle file up to 1 MiB, a JSON artifact up to 1 MiB, a workflow file up to 100 MiB (32 declared), up to 32 targets |
Who runs as whom
- An app call runs as the person viewing the app. What it reads is what that person may read.
- A coding agent over MCP runs as the person whose sign-in or token it carries.
- A scheduled workflow and a workflow screenshot run as the workspace's service identity, which reads only what is shared with the whole workspace.
- A schedule run is recorded against the schedule; a "Run now" is the starter's.
Who sees what
- You see your own workspace's apps, functions, workflows and runs; objects of another workspace answer "not found".
- A function's audience is private, its app, the workspace, or Bicycle's library. A draft version is private to whoever created it until published.
- Admins see every run in the workspace; others see their own.
What is untrusted
Outputs of functions, agents, Ask AI steps, classification, and anything read from a connection are data. Studio renders them as text and never follows instructions found in them; app code, workflows and agents must do the same. An agent may quote a ticket written by anyone.
What agents may do
Agents only read: your data model, connections they were given (read-only tools only), and functions they were granted. Writes happen only in workflow send steps, with approval.
Deleting is disabling
Functions and workflows are never hard-deleted. Disabling keeps pinned callers working, refuses new uses, and can be undone. Apps are unpublished or archived; their versions are kept.
Where to test
Bicycle's preview environment is for building and testing when you have access to it. Name test objects so they are easy to find ("Test: ..."), email only allowed addresses, never change an existing production app to test something, and disable test functions and workflows when done.
The public template is public
Anything committed to a clone of the data-app template can end up public: no customer model ids, metric names or real data in it. Examples use m_retail_demo.