Below the table, one card per severity lists the tools and the extension that provides them.
What you do here: check which tools can change data before you grant the AI agent to editors. To block individual tools, use the settings described in Governance.
Write and destructive tools never write on their own. The AI agent always shows a change card and waits for your explicit approval.