<.
- **Agent**: choose a role or model for each agent individually, in this order: "Project", "Chat", "Gem Studio", "Background tasks", followed by the agents of the gems you have installed; any you leave unset use the "Chat" role. See [Choose a model for each agent](/en/guide/models.md#choosing-a-model-for-each-agent).
## System › Network Access
Every network request made by the AI and gems, and every page opened by the built-in browser, is checked against the rules here. Addresses fall into two categories, each managed separately:
### Internet
Websites and online services.
- **Blocklist mode** (default): hosts on the list cannot be accessed; everything else can. An empty list means everything is open.
- **Allowlist mode**: only hosts on the list can be accessed.
Enter host names in the list, for example `api.example.com`; `*.example.com` means that domain and all subdomains under it.
### Local and internal network
Your computer, and the devices and services on your home or company internal network: routers, NAS, printers, cameras, and internal systems such as a company OA or wiki.
**By default, none of them can be accessed.** The AI and gems can use only the addresses you list here; the AI and gems cannot change this list themselves.
Why it is managed separately: these devices and services often have no password, because normally only people at home or in the company can reach them, and they often hold internal data. A web page the AI opens may hide instructions that trick it into visiting these addresses, and a third-party gem may also want to see what is on your internal network. Whether they can reach these is for you to decide, not for the AI or gems.
How to write entries:
- **Services on this computer need a port**, for example `localhost:5173`. Writing `localhost:5173` also opens `127.0.0.1:5173`. Writing just `localhost` does not work: that would open every service run by every program on your computer.
- **Devices on the internal network**: write an IP or a name, optionally with a port: `192.168.1.20`, `nas.local:5000`. `*.corp.example.com` means all hosts under this domain.
- Do not include `http://` or a path.
- Matching is by the name you wrote: if you list `192.168.1.20`, reaching the same device as `nas.local` is not allowed; list whichever name is used.
A common use: when developing a website, to let the AI test the site running on your computer in the browser, add `localhost:port` to the list.
Also:
- An address **you type yourself** in "Knowledge base › Import web page" may be an internal address (such as a company wiki) and does not have to be listed first; if that page redirects to another internal address, the list is still checked.
- For a gem to access the local and internal network, besides you listing the address, the gem itself must have requested it in its manifest; the gem page's "What it can do" states this.
- Service addresses you fill in yourself in Settings are not subject to these limits, for example a local model (Ollama at `localhost:11434`) or your company's internal mail server: you specified those yourself, and Notochord connects only to the address you entered.
]]>