## AI tokens {#on-the-page}
+
+
+**Give your AI a key, see who's using it, take it back in one tap.**
+
+### Make one {#make}
+1. Press **+ New token** at the top.
+2. Pick the kind: a **role token** for your AI agents (a designer, a coder…), or a **tool token** for one script or plugin.
+3. Pick how long it lasts, then **Make it**. Copy the value: it shows once.
+
+Give that value to your AI and it's in. It can do what you can on this project, at most the level you picked, and never more than your own role: if yours drops, its does too.
+
+### Your agents, at a glance {#agents}
+A role token mints a fresh **agent token** for every run of its role, each with its own name (designer-91, coder-302…). Its row says how many are live right now. Tap **2 live agents** to see them: when each one ends, and whether it **has it** or needs a **re-mint**. Expired and revoked agents never show.
+
+### Re-mint {#re-mint}
+An agent keeps the secrets it had when it was minted. Allow it a new secret on the [Vault](/ai/vault) and the agents already running can't read it yet: the Vault tells you and offers **Re-mint**. Here, **Re-mint agents** on a role, or **Re-mint** on one agent, gives it a fresh token with the same name and today's secrets, so nobody has to restart anything.
+
+### ⚡ Escalations {#escalations}
+Agents work on drafts: they can't delete or publish on their own. When one needs more, it asks you once, with a reason (*"Delete 50 old topics, P-1290"*). It reaches you as a **notice** with **Go**, **No** and **Open AI tokens**; opening the page dismisses the notice, and the ask waits there. Your **Go** gives it **admin for one hour**. It sits at the top of this page with its countdown and **Revoke**, and when the hour is up it shows **What it did**. Even then, anything your [Permissions](/ai/permissions) set to *asks* still asks you.
+
+### Tool tokens {#tools}
+For a program acting for you, such as a sync plugin or a connector. It works directly, under its own name, and mints nothing. Revoke it here when you stop using the tool.
+
+### Good to know {#notes}
-- A token acts as you in this project only, at most at the level you pick, and never above your own role: if yours drops, the token's does too.
+- Role, kind and level don't change once a token is made: revoke it and make a new one.
+- A token's value shows once. Lost it? Make a new one; the old one keeps working until you revoke it.
+- An agent can't read a secret? Check its row: an amber **re-mint** means it was minted before the secret was allowed.
-- Role, scope and level don't change once a token is made: revoke it and make a new one.
-- **Role tokens** mint one agent token per run. A token's value shows once, when it's made.
-- **Tool tokens** are for a program acting for you (a sync plugin, a connector). They work directly, under their own name, and mint nothing.