Matrix workspace

The Matrix workspace opens at /chat. Your administrator must provision its messaging connection before you can sign in: see Deploying messaging. This interface is under active development; agent execution, migration of existing chats and production rollout have separate readiness requirements.

Connect

The first time you open chat in a browser, Cortex signs you in to messaging automatically and returns you to chat. If that sign-in does not complete, select Connect to messaging to try again. Cortex checks that the messaging identity belongs to your signed-in organization. Your browser retains its messaging device and encryption keys between visits. Use the same browser profile to reopen your conversations. Messages sent before a browser signed in are restored on it from your message backup (below). Until they are, a new browser shows them as Sent before this device signed in.

If Messaging is unavailable appears, select Try again. If it persists, ask your administrator to check the workspace's messaging connection. A device recovery message means the saved keys cannot be opened safely. Do not clear site data to troubleshoot it: that removes the keys needed for this device's history.

One tab at a time

Only one tab of a browser can use your messages at a time. If you open Cortex in a second tab or window of the same browser profile, that tab says Cortex is open in another tab straight away instead of waiting in silence. It connects by itself when the other tab closes. To work in the new tab instead, select Use here: the other tab lets go and says the same notice, and you can switch back the same way. Browsers that cannot pass this request between tabs do not show Use here; close the other tab instead. Safari can put a background tab to sleep; when you return to it, Cortex reconnects by itself.

Earlier messages on a new browser

Your organization keeps an encrypted backup of your message keys, so a new browser can read the messages you received before it signed in. You do not set anything up and there is no key to save: the first time you sign in, Cortex creates the backup, and on every new browser it restores your earlier messages by itself. While it does, a notice says Restoring earlier messages on this device; you can keep chatting. If the download stops part-way, the notice says so, and Resume restoring resumes it. If the backup cannot be set up, for example because the connection dropped, the notice says so and Set up backup asks again. Every notice can be dismissed.

The backup is stored encrypted on your workspace's messaging server. The key that unlocks it is held by your organization and is given only to your own Cortex browser after you sign in, while you are a member of the organization. Each time it is given to a browser, the organization's audit log records it. Conversations stay end-to-end encrypted. Your organization's records are a separate copy: conversations that show records kept are retained by Scrydon Records either way.

If you saved a recovery key before. Earlier versions of Cortex asked you to create and keep a recovery key. If your backup is still locked by that key, a notice offers Enter saved key, and older messages show Sent before this device signed in. Enter your saved recovery key to read it. Enter it once and select Continue. Cortex moves your backup under your organization's key and restores your earlier messages; you will not need the recovery key again, and it stops working. If the key is wrong, Cortex says so and you can correct it; nothing is retried on your behalf. Once it is accepted, it is cleared from the page, and Continue in background closes the dialog while older messages keep downloading.

If another Matrix app set up a backup for your account that Cortex cannot unlock, Cortex never replaces it and offers nothing; use the app that created it. If your account's security keys were set up on another device and are not available in this browser, Cortex will not create new ones: verify this browser from that device first.

Conversations

The sidebar groups your conversations into Agents, Workspaces, Channels, People and Resources; select a group's name to fold it away or open it again. Type in the box above the list to narrow it to the conversations and people whose name matches; to search messages too, use Search. A channel with unread messages shows a dot; a direct message — with a person or with an agent — and a group conversation show the number of unread messages instead. A conversation that mentioned you shows an @: on a channel the @ takes the dot's place, and on a direct message it sits before the count. In a direct message, the other person's avatar carries a status dot: green for online, amber for away, grey for offline. A person's avatar shows the profile photo from their Scrydon profile. Someone without one, or whose photo cannot be loaded, shows their initials instead. Open a conversation to read and send messages. Sending is available once the room's encryption state is ready.

Your sidebar

Your own Cortex chat is pinned at the top of Agents. If you have not used it yet, the row is still there; select it to open the chat. Each shared workspace you belong to appears under Workspaces as a heading named after the workspace, with its channels beneath it; select the heading to fold it away or open it again. Rooms that belong to none of these groups are listed under Resources.

Channels

A shared workspace's conversations are its channels. Every shared workspace has a General channel, listed first; the other channels follow in alphabetical order.

• Who can manage channels. Workspace owners and admins see + beside the workspace's heading. Select it, give the channel a name (and a topic if you like) and select Create channel; the channel opens as soon as it is ready. The same people see a menu on every channel except General, with Rename and Archive. A member who is not an owner or an admin of the workspace cannot create, rename or archive channels, and neither can an organization administrator who has no role in the workspace.
• General is always there. It cannot be renamed or archived, and no other channel can be named "General". If your workspace had a room before channels existed, that room becomes General and keeps its history.
• Names. A channel name is at most 80 characters and must be unique in its workspace, ignoring case. A topic is at most 250 characters. A workspace can have up to 50 channels besides General.
• Archiving removes everyone from the channel and keeps its history. It is permanent: an archived channel cannot be restored, so create a new one if you need it again.
• Every channel shares the workspace. Its members are exactly the workspace's people, the same as General's, and they follow the workspace when someone joins or leaves it. In every channel, Cortex works in that workspace and uses only the accounts assigned to it, and a new channel starts at your organization's default classification, as General did. A service account that belongs to the workspace is listed too, tagged Automation. It is never a person you can mention, and it never writes on its own. A workflow that runs as that service account can post through Cortex, in the channels and the General of every workspace the account belongs to, and to people in the organization whom Cortex can message. It cannot post in the rooms of a workspace the account does not belong to. When the service account is disabled it leaves every channel within about a minute; when it is deleted it leaves for good, and its Cortex identity is deactivated.
• Private channels are not available in a workspace. You cannot create a workspace channel for only some of the workspace's people. An organization channel can be private.

Changes to channels can take up to a minute to appear for everyone.

Organization channels

An organization channel is a conversation for people across the organization, not tied to a workspace. Default is one; you can create others.

• Creating one. Select + beside Channels, then Create a channel. Give it a name, optionally a purpose, and choose who can join: Open or Private. Add people and teams, or none yet, and select Create channel. The channel opens once it is ready. If it is still being set up, Cortex says so and opens nothing, and the channel appears under Channels when it is ready. Closing the dialog does not cancel a create you have submitted. If Cortex cannot confirm the create, for example after a network failure, it says the channel may already exist: look under Channels before you create it again. Anyone in the organization can create a channel, and you are added to the one you create.
• Open and private. You see a channel in the sidebar when you are in it. Finding and joining an open channel you are not in is not available yet, so for now an open channel and a private one differ in one way: a private channel is never listed for anyone who is not in it, and a lock sits beside its name.
• People and teams. Adding a team puts everyone in that team in the channel, and the channel follows the team when someone joins or leaves it. Adding a person puts only that person in. Room info lists the channel's people and says why each is there: Added directly, or Through a team.
• Who can manage a channel. The person who created it and the organization's administrators. In a channel you are in, Room info shows Edit channel (name, purpose and who can join), Add people or teams, a remove button beside each team and beside each person added directly, and Archive channel. A person who is in the channel only through a team has no remove button: remove the team, or take them out of the team. If an edit or an add cannot be confirmed, Cortex says so and Room info shows what the channel holds now. Only organization administrators manage Default, and only its purpose can change: it cannot be renamed, made private or archived, and nobody is added to it or removed from it by hand. Everyone in the organization is in Default.
• Not in the channel now. People added directly who have since left the organization or been suspended are not in the channel, but they keep their place: they would be back in it if they returned, and they still count toward the channel's limit. Whoever manages the channel sees them in Room info under Not in the channel now, each with a remove button; nobody else sees that list. Remove them to keep them out.
• Archiving takes the channel out of the sidebar for everyone and keeps its history, and Room info says the channel is archived. It is permanent: an archived channel cannot be restored, so create a new one if you need it again.
• Names and limits. A name is 1 to 80 characters and unique in the organization, ignoring case; "Default" is taken. A purpose is at most 250 characters. An organization can have up to 500 channels, a channel up to 200 people and teams (a team counts once), and you can add up to 100 at a time. A team name longer than 255 characters is shortened where a channel shows it.
• How soon. A new channel, and people you add to one, appear within moments. A rename, a change to who can join, a removal and an archive can take up to a minute to reach everyone.

Which workspace Cortex uses

The room decides. In a room that belongs to a workspace, Cortex works in that workspace, and the room header says which one, for example "Cortex runs in Finance". If the workspace's name cannot be read, the header says "Cortex runs in a workspace". There is no workspace switcher in Cortex. A room that belongs to no workspace has no tools: Cortex can read the conversation and nothing else.

Every organization has a Default channel, and everyone in the organization is in it. It appears first under Channels in the sidebar and replaces the General room that the team including everyone used to have; Default starts empty, and the messages sent in that old room are not carried over to it. Teams no longer have rooms of their own: the old team rooms, General included, are closed, and nobody is in them any more. You are invited to Default when you join your organization and removed from it when you leave. Members cannot invite or remove anyone in Default or in your organization's space, and anybody who is in one of those rooms without being a member of the organization is removed. Changes can take up to a minute to appear. Any member can create more organization-wide channels, like Default: see Organization channels. An organization administrator manages teams from the + menu on the Channels heading: Manage teams opens Settings → Members → Teams.

Each shared workspace you belong to also has its own channels, starting with General (see Channels). You are invited to them when you can use the workspace, and removed when you no longer can. They hold the people who are an owner, an admin or a member of the workspace, directly or through a team. Viewers are not in them, and an organization administrator is in them only if they belong to the workspace. A workspace with no environment yet gets its channels once it has one. Changes can take up to a minute to appear.

In a workspace channel, Cortex answers everyone in it, so it uses only the accounts your administrator has assigned to that workspace. It does not use your own linked account, even if you have one for the same tool. When a tool needs your own account, Cortex says so and tells you to ask in your private chat with Cortex, where your own accounts are used.

To start a direct message, select + beside People or Agents in the room list (or New direct message beside the search box). Both groups are always shown, even before your first conversation. The dialog lists the people in your organization under People and your organization's Cortex under Agents. Search for a person by name or by their Matrix ID. Search uses the name a person had when they last opened Cortex, so a name change shows up the next time they open it. Each person is listed under that same name, even if you have never shared a room with them; someone without a name is listed as Participant. After an update, people already in your organization can be found by name only once they have opened Cortex again; until then, search for them by their Matrix ID. When more people match than one page holds, select Show more people to load the next page. Select a person to choose them: the button at the bottom of the dialog then reads Message followed by their name, and selecting it opens an end-to-end encrypted conversation with them. You are both invited straight away, and Scrydon Records is a member, so it shows Encrypted, records kept. Messaging the same person again — or that person messaging you — opens the same conversation. Colleagues who have not opened Cortex yet are listed too, under the name their organization profile carries, and your conversation with them carries that name until they sign in for the first time. You can message them straight away. A notice under the conversation's header says they have not opened Cortex yet and will see your messages when they do. The first time they open Cortex, their browser asks your organization for the keys to the messages sent before it existed, and they read the whole conversation. Those messages can carry a shield saying the sender's device cannot be verified, because the keys came from Scrydon Records rather than from your browser. This applies only to direct messages and group conversations: in a channel, people read only what is said after they join. A direct message opened before this was available switches the next time either of you chooses the other under New direct message. Until then the message box waits for their first sign-in, and anything sent before the switch stays unreadable to them. You do not have to accept anything: the app accepts every invitation your organization's own Cortex sends you — to a conversation, the Default channel, or a workspace and its channels — so a direct message someone else opened appears under People on its own. An invitation from another organization's Cortex, or from a person, still waits for you to accept it. Choosing Cortex opens your own end-to-end encrypted conversation with it: you do not need to mention @cortex there, every message you send is a question for Cortex. Scrydon Records is a member, so the conversation shows Encrypted, records kept. You have one such conversation; choosing Cortex again opens the same one, with its history.

To talk with several people at once, select more than one person under People before you start. The people you have chosen are listed above the results, and the button at the bottom of the dialog then reads, for example, Start a conversation with 3 people; the number counts the people you chose, not you. A group conversation holds you and two to seven other people, so three to eight people in total; once you have chosen seven, the other rows cannot be selected until you remove someone. Like a direct message, it is end-to-end encrypted, Scrydon Records is a member, and it shows Encrypted, records kept; everyone you chose is invited straight away. Choosing the same people again opens the same conversation, whichever of you does it and in whatever order. A group conversation has no name of its own: Cortex shows the names of the people in it, lists it under People, and draws it as two of their faces. When more than two other people are in it, the number of the rest follows the faces: a conversation of eight people shows two faces and +5, one of three shows two faces and no number. In the icon rail of a collapsed sidebar, it is drawn as a single round tile with a group icon instead of faces. Nobody can be added to a group conversation afterwards; to include someone else, start a new conversation with everyone. Leaving a group conversation is not available yet. A member who leaves your organization leaves the conversation; the others keep it and its history.

You can start up to 20 new group conversations in any rolling hour. Only a conversation you start counts: opening one that already exists, by choosing the same people again, is never counted or refused, and a direct message with one person is not limited. A conversation that could not be set up still uses one of the 20. When you reach the limit, the dialog says so, keeps the people you chose, and lets you try again later. You can still start a direct message with one person from the same dialog.

People who leave your organization (removed by an administrator, deprovisioned by your identity provider, or banned) are no longer listed, and a conversation with them can no longer be opened. They are also taken out of their direct messages and group conversations shortly after; the others keep the conversation and its history. If they rejoin, they are listed again but are not added back to an old conversation. Opening it again from the dialog brings them back, unless they had left it themselves before; then only they can reopen it.

Every conversation states its protection in the header: Encrypted, records kept, Encrypted, not recorded, Records kept, or Not encrypted, not recorded. "Encrypted" means the conversation is end-to-end encrypted; "records kept" means Scrydon Records — your own organization's records member, not a partner organization's — is a member of the conversation, so data loss prevention and audit apply to it. A conversation can be encrypted without being recorded, recorded without being encrypted, both, or neither.

Hover the protection summary to read what it means in full. The same line says how many members the conversation has, and on a wide window the header shows the faces of up to four of them at its right edge.

A conversation with a classification shows it in the classification scheme's own wording — for example NATO UNCLASSIFIED or NATO RESTRICTED — as a small label at the right edge of the header, whatever the level. The label stays in the header and does not scroll away with the messages.

A conversation that includes people from another organisation shows a banner under its header saying who it is shared with; the banner stays for as long as that is true and cannot be dismissed. Select Details on it to open the conversation panel.

Select Room info to open the conversation panel: About (the topic, when one is set), Protection and Classification (each explained as a full sentence), Workspace (whether agents here can reach that workspace's resources, and with whose permissions), and Members. Protection also says whether the conversation stays in your organisation, is shared with another, or could be joined by any organisation because nothing restricts it. Scrydon Records appears in the member list, tagged Records, whenever the conversation keeps records.

An agent's reply appears in the same list as everyone else's, tagged Agent, with a line underneath showing how long it took to reply and how many tokens it used.

While an agent works on a message in the conversation, a row with its name appears where its reply will go. The row shows the step the agent is on and how long it has been on it, for example "Searched tools" and then "Outlook · Read Email", and below that the steps it has finished, each marked as done, failed or refused. "Waiting for approval" means the agent asked before acting and is waiting for a reviewer. When the steps cannot be shown, the row reads "Working…".

When the agent finishes, the row stays, frozen, until its reply or notice appears (at most 15 seconds); a notice is the grey line described below. While it is frozen, its timer and spinner stop. Then the reply, with its Used line, takes over. If the agent starts working again before that, the row starts over. The row appears in the conversation itself, and only with the latest messages: it is not shown while you are reading older messages you jumped to, and it comes back when you select Jump to latest. A thread has no row; while an agent in the conversation works, it shows one line under the messages with the agent's name and "Working…", without steps. Screen readers announce each new step as it starts, and name every finished step as done, failed or refused.

The row shows only the names of the tools the agent uses: the same names the reply lists under Used. It never shows what the agent sent to a tool or got back. Only members of the conversation whose clearance admits it see the steps; for anyone else the row reads "Working…". Personas show "Working…" without steps, and so does Cortex in a conversation outside a workspace, because it answers there without tools.

When a colleague is typing, a line under the messages names them, for example "Mia is typing…". Two people are both named; with three or more it names the first and counts the rest ("Mia and 2 others are typing…"). It says "Someone is typing…" only for a person Scrydon has no name for. Typing belongs to the whole conversation, not to a thread, so the line shows the same people in the main conversation and in an open thread, whichever of the two they are typing in.

When Cortex starts working on a message and cannot answer it, you usually see a short grey line in its place. If Cortex has no model or environment it may use here, the line says so — an administrator can set one up, or choose another environment for Cortex under Governance. Any other failure, including an answer too long to post as one message, reads "Cortex did not answer this message". Either way, nothing was changed.

You also see "Cortex did not answer this message" when Scrydon stops a request itself:

• the conversation changed before the agent started — its workspace or its classification;
• the person who sent the message left the conversation or the organisation;
• Scrydon could no longer confirm the message itself when the agent started;
• Cortex gave up before it could start the request;
• the agent could not answer in this conversation — it was removed from it, or is not set up to run;
• the agent stopped working on the message without answering, for example because something it needed was refused while it worked. Scrydon notices within about two minutes;
• the request waited more than an hour before an agent could start on it. A request that has already started is never stopped for taking long.

If a persona's or Cortex's answer cannot be posted, Scrydon keeps trying for an hour after the answer last moved forward — about two hours at most. Then the room shows "Cortex did not answer this message" with Try again. Cortex itself posts that line, because the agent that answered could not post in the conversation; if Cortex cannot post there either, nothing appears. A request that was cancelled gets no such line, since there is nothing to try again.

In a shared conversation, Cortex may find an answer that draws on information classified above the conversation's own classification. Scrydon does not post that answer. Instead the room shows "Cortex found an answer but can't show it in this room." — without the answer, its classification or its sources, and with no Try again, because the same question in the same conversation would end the same way.

When the agent itself cannot post one of the lines above, the line appears once the agent can post again. If it still cannot an hour after the request last moved forward — about two hours at most — the request ends without a line. If an agent is no longer typing and nothing appears, send the message again.

The person who sent the message sees Try again beside a failed answer, which sends the same message again. While it is sending, Try again is greyed out. Once that message has gone out, Try again disappears from that answer until you leave the chat or reload the page (switching between conversations keeps it hidden), so one press sends one new request; if sending failed, it stays. A request that was cancelled offers no Try again, and neither does an answer the agent finished but that could not be shown — one too long to post, an empty reply, or a persona result without its classification mark: the same message would most likely end the same way.

Formatting messages

Write a message in Markdown, the way GitHub reads it, and Cortex shows it formatted. Agents' answers are formatted the same way.

For a block of code, put it between two lines of three backticks, and name the language after the first:

```ts
const answer = 42;
```

The block shows the language and a Copy button. Long lines scroll sideways instead of wrapping, and the code is coloured for its language as it scrolls into view. A very long block (over 5,000 characters or 300 lines) is shown without colour.

A mermaid block in someone's message stays a block of code. Only an agent's answer draws it as a diagram.

In the message box, Shift+Enter starts a new line. Inside a block of code you have opened with three backticks and not closed yet, Enter starts a new line too, so you can type code line by line; once you close the block, Enter sends. When you type with an input method (Japanese, Chinese, Korean and others), the Enter that confirms a word belongs to the input method and never sends a half-written message. A mention stays a mention in bold text, a list or a quote; inside code it is plain text. A person's name is always shown as their name, even when it contains characters that Markdown would otherwise format.

Some things are never drawn as written:

• Images. ![caption](https://…) shows as a link with its caption. Cortex does not load the image by itself, because loading it would tell whoever wrote the link who read the conversation, and when. Select the link to open it.
• HTML. Tags you type show as the text you typed.
• Links. Only a full web or email address (https://…, http://…, mailto:…) can be selected. Any other link is shown as its text: a link that runs code (javascript:), a path such as /settings, and an address that starts with //.
• Hidden text. Markdown that would draw nothing is shown as the text that was sent: a line such as [//]: # (note), a footnote that nothing refers to, and a link with no text.

Notices, and the action messages other Matrix apps send with /me, are shown as written, without formatting. Other Matrix apps show your message as the Markdown you typed: Cortex sends the text only, with no formatted copy.

Edit, delete and link to a message

Point at a message, or focus it with the keyboard, and More actions appears beside the reaction and reply-in-thread buttons. What it offers depends on whose message it is.

• Edit puts the words of one of your own text messages back in the message box, with a bar that says you are editing, Cancel and Save. There is no time limit. Saving changes the message for everyone in the conversation, and it shows Edited beside its time. Files, notices and other people's messages have no Edit, and neither does a message somebody else has since edited. Cortex does not answer an edited message again: an answer to the earlier text stays as it was. Where that answer offers Ask again, it notes that Cortex answered the earlier text, and Ask again sends the new text. If the edit cannot be saved, Cortex says so and the message keeps its words.
• Delete asks first, then removes one of your own messages for everyone in the conversation. It cannot be undone, and it works on your files and notices too. The row stays in the conversation, shown as Message removed, and a thread that began with it keeps its replies. If the message cannot be deleted, Cortex says so and the message stays as it was. Delete is offered only on your own messages, whatever your role in the conversation.
• Copy link puts the address of any message in the clipboard and says Link copied. Paste it to a colleague: when they open it, Cortex opens that conversation at that message and highlights it for a moment, and a link to a reply opens the thread. The link is an address in Cortex, not a public one: only people in the conversation can open it, and anyone else lands on the workspace with no conversation open. A link to a message still being sent has none to copy, so the menu does not appear on it.

If you follow a link to a message that this browser has not loaded, Cortex opens the conversation and says That message isn't loaded on this device. Scroll back through the conversation to find it. The same notice appears when a search result or a desktop notification points at a message that is not loaded.

Search rooms and messages

Press ⌘K (macOS) or Ctrl+K anywhere in the workspace, or select the key cap beside the box above the conversation list, to open the search. Type to find conversations by name and messages by their text: the results are grouped under Rooms and Messages. Each message shows its conversation, who sent it and when, with the conversation's classification marking when it has one. Select a conversation to open it, or a message to open its conversation at that message: the message is highlighted for a moment, and a reply in a thread opens the thread. Choosing a different conversation before the message appears cancels the jump.

Messages are end-to-end encrypted, so the server cannot search them. The search reads only the messages this browser has loaded and can decrypt, and says so under the results: Searched the messages loaded on this device. Older messages are usually included once you have scrolled back to them in their conversation; after a long time offline, messages from before the gap may not be. When some loaded messages cannot be decrypted on this device, the search adds Some messages could not be read on this device. It lists the newest 50 matching messages, and says so when more matched.

Messages are searched only in conversations your clearance admits. Conversation names still match under Rooms, but the messages of a conversation marked above your clearance are not searched, nor are the messages of a conversation whose marking cannot be read, nor, while Cortex cannot confirm your clearance, those of any marked conversation. The search then says Some rooms were not searched. It never says how many, or which.

See whether your message has been read

Each of your messages carries a small tick beside its time, as in a messaging app. Other people's messages carry none.

A message that could not be sent has no tick. It shows Message could not be sent with Try again instead.

Select the two checks, or move keyboard focus to them and press Enter, to list who has read the message. The tick is also named for a screen reader: Sending, Sent, Read by 2 of 3 or Read by everyone.

Matrix has no "delivered" receipt, so Cortex shows no tick for it. Only the people in the conversation count towards "everyone"; agents, which never send read receipts, do not, and neither does anyone who has left. A read receipt for a later message counts as having read the earlier ones. Only read receipts a reader's app shares are counted: someone whose app keeps its receipts private, or sends none, is not shown.

Notification level per room

Each conversation has a notification level that decides how much it asks of your attention: All messages, Mentions only or Off. A conversation is at All messages until you change it.

• All messages: every new message counts as unread in the conversation list (a dot on a channel, a count on a direct conversation) and can notify you.
• Mentions only: only a message that mentions you counts and can notify you. The list shows the @ mark for a mention and no count for the rest.
• Off: nothing about the conversation asks for your attention. It has no dot, no count, no @ and no notification, a mention included. The messages are still there when you open it.

To change the level, hover a conversation in the list and select its ... menu (on a narrow screen it is always shown). Under Notifications, choose a level. Every row has this menu, a private Cortex chat nested under a workspace channel included. The same choice is in Room info, under Notifications. On a channel you manage, the ... menu also holds Rename and Archive, below the notification levels.

A conversation set to Off shows a bell with a slash after its name. One set to Mentions only shows nothing extra, so its @ is only ever the mention mark; look at the ... menu or Room info to see the level. Both levels are read out with the conversation's name, as Mentions only and Notifications off. If a change cannot be saved, Cortex says Could not change notifications for this room. Try again. and the conversation keeps the level it had.

Your personal Cortex chat and your conversations with agents offer All messages and Off only. An agent answers you and never mentions you, so Mentions only would never notify.

The level belongs to your account, not to the browser. Set it on one device and it applies on every device and browser where you use Cortex, once they have caught up. A level set from another Matrix app on the same account shows here too, when it is a mute (Off) or a silent room rule (Mentions only).

The Desktop notifications switch described next is different: it is kept per browser. The level chooses which messages count for a conversation; the switch chooses whether this browser shows notifications at all. A conversation set to Off shows none, even with the switch on.

Desktop notifications

Cortex can show a notification on your computer when a message arrives. It does so while Cortex is open in a browser tab, including a tab you are not looking at. It does not reach you once every Cortex tab is closed.

They are off until you turn them on. At the bottom of the conversation list, turn on the Desktop notifications switch, and your browser then asks whether to allow notifications from Cortex. Nothing is asked before you do. While the prompt is open, a line under the switch says to answer it there. If you close the prompt without answering, the switch stays off and the line says it is not allowed yet; turn the switch on again and the browser asks again. The choice is kept for this browser on this device only: turn it on again wherever else you use Cortex.

A notification says where a message came from and never what it says. It shows the conversation's name and New message from the sender, or, in a direct conversation, the person's name and New message. The text, attachments and previews of a message never appear in it, so they cannot be read from the lock screen or the notification centre.

Which messages notify follows the notification rules of your Matrix account: a conversation you have muted stays silent. Cortex also stays silent for:

• your own messages;
• edits, reactions and deleted messages;
• messages that were already waiting when you opened Cortex, or that arrive more than five minutes after they were sent;
• messages this device cannot decrypt;
• a conversation, or a thread, that is open in a window you are looking at.

Each conversation has at most one notification: a newer message replaces the older one. Select a notification to bring the browser window forward and open the conversation, or the thread when the message is a reply in one. Opening the conversation yourself clears its notification.

If your browser is blocking notifications for Cortex, turning the switch on does not show a prompt: the switch stays off and a line under it says why. It reads Your browser is blocking notifications for this site, so it will not ask, and tells you what to do: open the site settings (the icon left of the address), allow notifications, then turn the switch on. A browser blocks a site when the site is set to Block, when you refused or dismissed its prompt before, when its own settings block notifications for every site at once, or in a private window. Once it is blocking, it does not show the prompt again, so Cortex cannot ask again. Come back to the tab after you allow notifications and turn the switch on. A browser that cannot show notifications is not offered the control.

Messages from automations

A workflow can send you a message in Cortex: a report when it is ready, or an alert when something needs you. The message comes from Cortex, in your own conversation with Cortex or in a room you are in: a channel or a workspace's General. A line under it says which automation sent it: via and the workflow's name. A message Cortex sent because someone asked it to in a conversation reads via a Cortex conversation. The line also names who asked: asked by and their name, when the room or your organization's directory knows it.

The line reads via an automation instead when:

• the message came from a process flow;
• you cannot open the workflow that sent it;
• the workflow is in a different environment from the conversation's or from your active one.

The line appears only under messages Cortex itself sent from your organization's server. Someone who copies the same details into a message of their own gets no line. A message from an automation mentions nobody: @room and people's names show as plain text and notify no one.

Personas and approvals in a room

Some of the agents in your workspace are personas: each one is set up to carry out a specific set of steps rather than just answer a question. Address a persona in a room and it answers by running through those steps — using your own permissions, and under the room's classification. It can only reach what you could reach yourself, and nothing it does can send the room's content anywhere rated below the room's classification: a persona can do exactly what @cortex may do in that room, never more. If a persona's answer draws on something rated above the room's classification — or on content rated under a different classification scheme from the room's, which cannot be compared with it — the answer is not posted: as with an answer your organisation's data-protection policy blocks, nothing appears in the room and the persona moves on to the next message.

The same rule decides which tools @cortex and a persona can use. A conversation with no classification of its own counts as your organization's default classification, and an account nobody has rated counts as the level your organization chose for unrated accounts: INTERNAL for an organization created after that setting was added, PUBLIC for an older one unless an administrator changed it (see Classification and clearance). So when your organization runs in Enforce, a tool on an unrated account is refused in every conversation classified above that level — reading mail through an unrated Outlook connection in a CONFIDENTIAL room, for example. Rate the accounts your agents use under Settings → Governance → Identity → Endpoints, at or above the classification of the conversations they work in. When a tool is refused this way, Cortex tells you the account is not rated and points you to that page.

When a tool is refused because its account is not rated for the conversation, not connected for you, not assigned to the conversation's workspace, or usable only in your private chat, Cortex shows a fix card under the answer for each extension or MCP server concerned, up to three. The card names it, says what is wrong, and offers only what you can do:

• Rate it, for an organization admin, opens Settings → Governance → Identity → Endpoints.
• Connect name, for the person who asked, when their own account is missing or needs reconnecting, opens Settings → Account → Connected Accounts.
• Assign an account, for an organization admin or an admin of the conversation's workspace, opens the Extensions tab of that workspace.
• Ask again, for the person who asked, sends their question again as a new message, except on a card that points to their private chat. While it is sending it is greyed out. Once it has gone out it disappears from that answer until you leave the chat or reload the page; if sending failed, it stays.
• Ask in my private chat, for the person who asked, when only their own account could answer and the conversation is shared, puts the question in their private Cortex chat for them to send.

Everyone else sees who has to act. The answer's text still explains the problem, so other Matrix apps, which show no card, lose nothing.

Tools are also offered by the asker's clearance: a connection that requires more clearance than the person asking holds is not offered to them. See Clearance.

To create an agent of your own, see Create an agent.

When a persona answers with structured data rather than text, the answer appears as a formatted JSON code block, with a copy button. A very long block is shortened to the answer length limit. A block that is still too large to post as one message is not cut further: the room shows "Cortex did not answer this message", without Try again, as for any answer too long to post. An empty object or array is not posted at all.

If a persona's steps need someone to sign off before continuing, a card appears in the room in place of an answer. The card names who needs to approve it and how many approvals it needs. Only the people it names see Approve and Reject on the card; everyone else sees the card without the buttons.

When the persona's author wrote down what the persona wants to do, the card is titled with that; otherwise it reads Needs approval before it runs. A bar under the title shows how much of the approval window is left, and the time remaining is shown beside Waiting for approval. A persona you own is marked Yours. An approval stays open for 24 hours. After that nobody can approve or reject it: the buttons disappear, the card shows Expired before it was decided, and the room shows "Cortex did not answer this message" with Try again, which sends your message again so a new approval can be asked for.

While a persona waits for that sign-off it stops showing as typing, and it does not hold the room's worker. Messages sent to agents in the same room meanwhile wait their turn behind it, and are answered in order once it finishes. Approving lets the persona carry on at once, but its answer appears in the room the next time Cortex checks on the paused work — after a long review that can be up to ten minutes after the approval. Rejecting stops it there.

If a waiting request can no longer run — the persona is retired, or the person who asked leaves the room or the organisation, or the room's workspace or classification changes — it ends as failed, its approval card stops offering a decision, and the room moves on to the next message. If the card cannot be updated at that moment its buttons may still look active, but they no longer decide anything: choosing one is refused. A request that had already finished before this happened keeps its finished answer.

The same holds when Cortex stops a request for any other reason once it has started — for example when, after picking the work back up, it can no longer confirm the request may still run. Anything the persona had already answered is still posted, and an approval card from that request never offers a decision: it is either not shown at all or shown as expired.

When Cortex asks before acting

In a workspace room, Cortex can use your workspace's tools while it answers. Most tools that only read run straight away. Before Cortex uses a tool that sends, creates, changes or deletes something, it stops and asks you first. Two kinds of tool ask first even when they only read:

• Every tool from an MCP server, whatever the server says about the tool, because Scrydon cannot verify that claim.
• A tool that reads from an address Cortex chooses itself, such as a web page, a server or another agent, because what it sends there could carry what Cortex has read.

In a workspace room shared with other people, Cortex does not offer tools from an MCP server that each person signs in to with their own account. Cortex would otherwise answer everyone in the room with the asker's personal access. MCP servers that use a sign-in set up for the workspace, or no sign-in, are unaffected, and in your personal conversation with Cortex you can still use servers you have signed in to yourself.

The question appears in the room as an approval card. The card names the tool and shows every value Cortex wants to use, in full, so what you approve is exactly what runs. A call too large to show in full on the card is not offered for approval: Cortex is told to shorten it or split it into smaller calls, and nothing runs until a card can show all of it. Only the person who asked Cortex the question can decide: everyone else sees the card without Approve and Reject. Nobody else in the room, and no agent, can approve it for you.

• Approve: the tool runs once, with the values on the card, and Cortex carries on with its answer.
• Reject: the tool does not run. Cortex is told you declined and answers without it.
• No decision: the card stays open for 24 hours. After that it expires as a persona's approval does, and the tool does not run: the room shows "Cortex did not answer this message" with Try again.

Rarely, Cortex cannot tell whether an approved tool finished: for example, when the service running Cortex restarts while the tool is running. Cortex then does not run the tool a second time. It is told the outcome is unknown and should say so in its answer; in some cases the room shows "Cortex did not answer this message" instead. In either case, after you approved a tool, check the system the tool acts on (for example your sent mail) before you ask Cortex to do it again, or it may happen twice.

Hover over a message, or move keyboard focus into it, to show its actions: Add a reaction and Reply in thread. On a touch screen they are always shown, under the message. Use Reply in thread to keep a discussion attached to its original message; once a thread has replies, the message shows how many and who replied. Choosing Reply in thread, or the reply count on a message, opens the thread and puts the cursor in its message box, after any draft you already have there, so you can type your reply straight away. If the box is not ready yet, for example while the thread is still loading, the cursor goes there as soon as it is. A thread you open from a search result does not take the cursor.

Typing an emoticon in a message box turns it into the emoji once you finish it with a space, a new line or punctuation such as a full stop or a comma, or send the message: :) becomes 🙂, :D 😃, ;) 😉, :( 🙁, :P 😛, :O 😮, :'( 😢, <3 ❤️, </3 💔, :* 😘, XD 😆, :| 😐, :/ 😕 and B) 😎. The forms with a nose, such as :-), work too. Only a whole emoticon is replaced: not inside a word, a link, an @ mention, inline code or a fenced code block. Press Backspace straight after a replacement to get what you typed back; the next key press makes the emoji permanent.

Replies from Cortex and from agent personas are formatted: tables, lists and code render as such. An image in an agent's reply is shown as a link and is only loaded if you open it. Diagrams in a reply are drawn from their text only; any markup inside a diagram label is not rendered. When an agent cites sources, they appear as chips under its reply, and a line in small type shows how long the reply took and how many tokens it used. Messages from people are shown exactly as they were typed. Each conversation and thread retains its own draft while the workspace is open. A conversation holding a draft you have not sent, in its message box or in one of its threads, shows a small pencil beside its name in the sidebar, in the search (⌘K or Ctrl+K) and on the collapsed icon rail, so you can find your way back to it. The conversation you have open shows no pencil. Drafts live only in the open workspace: nothing saves them, and reloading the page loses them. On a larger screen the Thread and Room info panel opens beside the conversation; on a phone it opens over it, and the Conversations button in the header opens your conversation list. The member list is inside Room info.

The sidebar's collapse button leaves an icon rail of the conversations that need you: those with unread messages or a mention, plus the one you have open. Expand the sidebar again for the full list and its search box.

Messages and encryption are managed by Matrix. The browser's saved credentials are encrypted with a non-exportable browser key; this does not protect an unlocked browser profile from malicious code running on the same origin. Existing Cortex chat history is not automatically converted into Matrix rooms.