diff --git a/apps/docs/content/docs/workflows/blocks/agent.mdx b/apps/docs/content/docs/workflows/blocks/agent.mdx
index 0ef2b325ac5..b880916cd78 100644
--- a/apps/docs/content/docs/workflows/blocks/agent.mdx
+++ b/apps/docs/content/docs/workflows/blocks/agent.mdx
@@ -33,12 +33,14 @@ Files for the model to read: images for a vision-capable model, or documents for
 
 ### Tools
 
-Capabilities the agent can call while it runs: search a knowledge base, send a Slack message, run a [Function](/workflows/blocks/function), call any of the [integrations](/integrations), or use a [custom tool](/agents/custom-tools) or [MCP server](/agents/mcp) you've added. The model decides which to call and when. (For where tools come from and when to reach for which, see [Agents](/agents).) Each tool has a usage control:
+Capabilities the agent can call while it runs: search a knowledge base, send a Slack message, run a [Function](/workflows/blocks/function), call any of the [integrations](/integrations), or use a [custom tool](/agents/custom-tools) or [MCP server](/agents/mcp) you've added. The model decides which to call and when. (For where tools come from and when to reach for which, see [Agents](/agents).) Expand a tool to set its **Permission Mode**:
 
 - **Auto.** The model calls it when the context warrants.
 - **Force.** The model must call it on every run.
 - **None.** The tool is hidden from the model, which disables it without removing it from the block.
 
+To pick the mode when the workflow runs, use the switch next to Permission Mode to change it to a variable, then enter a reference such as `<start.toolMode>`. The value must resolve to `auto`, `force`, or `none`. Any other value stops the run before the model is called.
+
 ### Skills
 
 [Agent skills](/agents/skills) the agent can load on demand: reusable instruction packages like a coding standard or a support playbook. Only the skill names sit in context up front, and the agent loads the full instructions when it decides a skill is relevant.