diff --git a/packages/archioffice-agents/src/client/AgentConfig.tsx b/packages/archioffice-agents/src/client/AgentConfig.tsx
index eb2925a..b13985b 100644
--- a/packages/archioffice-agents/src/client/AgentConfig.tsx
+++ b/packages/archioffice-agents/src/client/AgentConfig.tsx
@@ -3,7 +3,8 @@ import { useParams, useNavigate } from 'react-router-dom';
 import { useTranslation } from 'react-i18next';
 import { IconArrowLeft, IconRobot, IconChevronDown } from '@tabler/icons-react';
 import { apiFetch } from '@/src/lib/api';
-import type { Agent, AgentContextScope } from '../types.js';
+import type { Agent, AgentContextScope, AgentActionScope } from '../types.js';
+import { AGENT_RESOURCES } from '../types.js';
 
 const AVATAR_COLORS = ['#206bc4', '#2fb344', '#f76707', '#ae3ec9', '#1098ad', '#e8590c'];
 
@@ -15,6 +16,10 @@ const SCOPES: { key: AgentContextScope; label: string }[] = [
   { key: 'tasks',     label: 'Tâches' },
 ];
 
+// One toggle per resource grants that resource's full create/update/delete
+// surface — the same surface a human has in that section of the app.
+const ALL_ACTION_KEYS: AgentActionScope[] = AGENT_RESOURCES.map(r => r.key);
+
 export default function AgentConfig() {
   const { id } = useParams<{ id: string }>();
   const navigate = useNavigate();
@@ -33,6 +38,7 @@ export default function AgentConfig() {
   const [tone, setTone] = useState('');
   const [directives, setDirectives] = useState('');
   const [contextScopes, setContextScopes] = useState<AgentContextScope[]>([]);
+  const [actionScopes, setActionScopes] = useState<AgentActionScope[]>([]);
   const [systemPromptOverride, setSystemPromptOverride] = useState('');
 
   useEffect(() => {
@@ -48,6 +54,7 @@ export default function AgentConfig() {
         setTone(found.tone ?? '');
         setDirectives(found.directives ?? '');
         setContextScopes(found.context_scopes as AgentContextScope[]);
+        setActionScopes((found.action_scopes ?? []) as AgentActionScope[]);
         setSystemPromptOverride(found.system_prompt_override ?? '');
       })
       .finally(() => setLoading(false));
@@ -59,6 +66,17 @@ export default function AgentConfig() {
     );
   };
 
+  const toggleActionScope = (scope: AgentActionScope) => {
+    setActionScopes((prev: AgentActionScope[]) =>
+      prev.includes(scope) ? prev.filter((s: AgentActionScope) => s !== scope) : [...prev, scope]
+    );
+  };
+
+  const allActionsSelected = ALL_ACTION_KEYS.every(k => actionScopes.includes(k));
+  const toggleAllActionScopes = () => {
+    setActionScopes(allActionsSelected ? [] : [...ALL_ACTION_KEYS]);
+  };
+
   const handleSave = async () => {
     if (!agent) return;
     setSaving(true);
@@ -69,6 +87,7 @@ export default function AgentConfig() {
           name, role_title: roleTitle, avatar_initials: avatarInitials,
           avatar_color: avatarColor, tone, directives,
           context_scopes: contextScopes,
+          action_scopes: actionScopes,
           system_prompt_override: systemPromptOverride || null,
         }),
       });
@@ -191,6 +210,35 @@ export default function AgentConfig() {
         </div>
       </section>
 
+      {/* Actions — write permissions */}
+      <section className="p-5 rounded-xl border space-y-3" style={{ background: 'var(--tblr-surface)', borderColor: 'var(--tblr-border)' }}>
+        <div className="flex items-center justify-between gap-3">
+          <h2 className="font-semibold text-[14px]" style={{ color: 'var(--tblr-text)' }}>{t('agent_config_actions')}</h2>
+          <button
+            onClick={toggleAllActionScopes}
+            className="text-[12px] font-medium hover:underline shrink-0"
+            style={{ color: 'var(--tblr-primary)' }}
+          >
+            {allActionsSelected ? t('agent_config_actions_clear_all') : t('agent_config_actions_select_all')}
+          </button>
+        </div>
+        <p className="text-[11px]" style={{ color: 'var(--tblr-muted)' }}>{t('agent_config_actions_hint')}</p>
+        <div className="space-y-2">
+          {AGENT_RESOURCES.map(scope => (
+            <label key={scope.key} className="flex items-center gap-3 cursor-pointer group">
+              <input
+                type="checkbox"
+                checked={actionScopes.includes(scope.key)}
+                onChange={() => toggleActionScope(scope.key)}
+                className="w-4 h-4 rounded"
+                style={{ accentColor: 'var(--tblr-primary)' }}
+              />
+              <span className="text-[13px]" style={{ color: 'var(--tblr-text)' }}>{scope.label}</span>
+            </label>
+          ))}
+        </div>
+      </section>
+
       {/* Advanced prompt */}
       <section className="p-5 rounded-xl border space-y-3" style={{ background: 'var(--tblr-surface)', borderColor: 'var(--tblr-border)' }}>
         <button
diff --git a/packages/archioffice-agents/src/server/routes.ts b/packages/archioffice-agents/src/server/routes.ts
index c4e7ff7..b9eed00 100644
--- a/packages/archioffice-agents/src/server/routes.ts
+++ b/packages/archioffice-agents/src/server/routes.ts
@@ -3,6 +3,7 @@ import type { AgentRow } from '../types.js';
 import { buildAgentSystemPrompt } from './systemPrompts.js';
 import { buildAgentContext } from './context.js';
 import { parseArtifactFromText, generateArtifact } from './artifacts.js';
+import { buildAgentTools, executeAgentAction } from './tools.js';
 
 type GetTenantId = (userId: string) => Promise<string>;
 type GetTenantPlan = (tenantId: string) => Promise<{ plan: string; trial_ends_at: string | null; is_expired: boolean }>;
@@ -17,6 +18,11 @@ interface BillingHelpers {
   deductAiCredit: DeductAiCreditFn;
   maybeRefreshMonthlyCredits: (tenantId: string, plan: string) => Promise<void>;
   PLAN_AI_MONTHLY_CREDIT_CENTS: Record<string, number>;
+  // Base URL the agent action tools call back into (e.g. http://127.0.0.1:PORT)
+  // — actions execute through the app's own REST API, forwarding the
+  // caller's auth token, so they run through the exact same validation and
+  // side effects as a human using the UI.
+  baseUrl: string;
 }
 
 export function registerAgentRoutes(
@@ -50,7 +56,7 @@ export function registerAgentRoutes(
   app.post('/api/agents', async (req: any, res: any) => {
     try {
       const tenantId = await getTenantId(req.user.id);
-      const { slug, name, role_title, avatar_initials, avatar_color, tone, directives, context_scopes, system_prompt_override, from_template_id } = req.body;
+      const { slug, name, role_title, avatar_initials, avatar_color, tone, directives, context_scopes, action_scopes, system_prompt_override, from_template_id } = req.body;
 
       let agentData: any = { tenant_id: tenantId };
 
@@ -58,10 +64,12 @@ export function registerAgentRoutes(
         const { data: template, error: tErr } = await supabaseAdmin.from('agents').select('*').eq('id', from_template_id).is('tenant_id', null).single();
         if (tErr || !template) return res.status(404).json({ error: 'Template not found' });
         const t = template as any;
-        agentData = { ...agentData, slug: t.slug, name: t.name, role_title: t.role_title, avatar_initials: t.avatar_initials, avatar_color: t.avatar_color, tone: t.tone, directives: t.directives, context_scopes: t.context_scopes, is_active: true, is_system_template: false };
+        // Write permissions are never inherited from a template — the tenant
+        // must opt in explicitly per activated agent.
+        agentData = { ...agentData, slug: t.slug, name: t.name, role_title: t.role_title, avatar_initials: t.avatar_initials, avatar_color: t.avatar_color, tone: t.tone, directives: t.directives, context_scopes: t.context_scopes, action_scopes: [], is_active: true, is_system_template: false };
       } else {
         if (!slug || !name || !role_title) return res.status(400).json({ error: 'slug, name, role_title required' });
-        agentData = { ...agentData, slug, name, role_title, avatar_initials: avatar_initials || 'AI', avatar_color: avatar_color || '#206bc4', tone, directives, context_scopes: context_scopes || [], system_prompt_override, is_active: true, is_system_template: false };
+        agentData = { ...agentData, slug, name, role_title, avatar_initials: avatar_initials || 'AI', avatar_color: avatar_color || '#206bc4', tone, directives, context_scopes: context_scopes || [], action_scopes: action_scopes || [], system_prompt_override, is_active: true, is_system_template: false };
       }
 
       const { data, error } = await supabaseAdmin.from('agents').insert(agentData).select().single();
@@ -75,8 +83,8 @@ export function registerAgentRoutes(
     try {
       const tenantId = await getTenantId(req.user.id);
       const { id } = req.params;
-      const { name, role_title, avatar_initials, avatar_color, tone, directives, context_scopes, system_prompt_override, is_active } = req.body;
-      const { data, error } = await supabaseAdmin.from('agents').update({ name, role_title, avatar_initials, avatar_color, tone, directives, context_scopes, system_prompt_override, is_active }).eq('id', id).eq('tenant_id', tenantId).select().single();
+      const { name, role_title, avatar_initials, avatar_color, tone, directives, context_scopes, action_scopes, system_prompt_override, is_active } = req.body;
+      const { data, error } = await supabaseAdmin.from('agents').update({ name, role_title, avatar_initials, avatar_color, tone, directives, context_scopes, action_scopes, system_prompt_override, is_active }).eq('id', id).eq('tenant_id', tenantId).select().single();
       if (error) throw error;
       res.json(data);
     } catch (e: any) { res.status(500).json({ error: e.message }); }
@@ -201,28 +209,60 @@ export function registerAgentRoutes(
         parts: [{ text: m.content }],
       }));
 
+      const actionScopes: string[] = (agent as any).action_scopes || [];
+      const tools = buildAgentTools(actionScopes);
+
       const chat = genai.chats.create({
         model: 'gemini-3-flash-preview',
-        config: { systemInstruction: systemPrompt },
+        config: {
+          systemInstruction: systemPrompt,
+          ...(tools.length > 0 ? { tools: [{ functionDeclarations: tools as any }] } : {}),
+        },
         history: geminiHistory,
       });
       // Bounds how long a stuck/slow Gemini call can hold the request open —
       // shorter than the client's own abort timeout so the client always gets
       // this explicit message instead of a silent connection drop.
       const AGENT_CHAT_TIMEOUT_MS = 55000;
-      const result = await Promise.race([
-        chat.sendMessage({ message }),
+      const withTimeout = <T>(p: Promise<T>): Promise<T> => Promise.race([
+        p,
         new Promise<never>((_, reject) =>
           setTimeout(() => reject(Object.assign(new Error("L'agent IA n'a pas répondu à temps."), { code: 'AGENT_TIMEOUT' })), AGENT_CHAT_TIMEOUT_MS)
         ),
       ]);
-      const rawText = result.text ?? '';
 
-      const inputTokens  = (result as any).usageMetadata?.promptTokenCount ?? 0;
-      const outputTokens = (result as any).usageMetadata?.candidatesTokenCount ?? 0;
+      let result = await withTimeout(chat.sendMessage({ message }));
+      let inputTokens  = (result as any).usageMetadata?.promptTokenCount ?? 0;
+      let outputTokens = (result as any).usageMetadata?.candidatesTokenCount ?? 0;
+
+      // Function-calling loop: the model may chain several tool calls (e.g.
+      // create_contact then create_proposal with the returned id) before it
+      // produces a final natural-language reply.
+      const actionSummaries: string[] = [];
+      const MAX_FUNCTION_ROUNDS = 4;
+      let round = 0;
+      if (tools.length > 0 && billing?.baseUrl) {
+        const authHeader = req.headers.authorization as string | undefined;
+        while (result.functionCalls && result.functionCalls.length > 0 && round < MAX_FUNCTION_ROUNDS) {
+          round++;
+          const responseParts: { functionResponse: { name?: string; response: Record<string, unknown> } }[] = [];
+          for (const call of result.functionCalls) {
+            const { response, summary } = await executeAgentAction(billing.baseUrl, authHeader, actionScopes, call);
+            if (summary) actionSummaries.push(summary);
+            responseParts.push({ functionResponse: { name: call.name, response } });
+          }
+          result = await withTimeout(chat.sendMessage({ message: responseParts }));
+          inputTokens  += (result as any).usageMetadata?.promptTokenCount ?? 0;
+          outputTokens += (result as any).usageMetadata?.candidatesTokenCount ?? 0;
+        }
+      }
+
+      const rawText = result.text ?? '';
 
       const { cleanText, spec } = parseArtifactFromText(rawText);
-      const reply = cleanText;
+      const reply = actionSummaries.length > 0
+        ? actionSummaries.map(s => `✅ ${s}`).join('\n') + '\n\n' + cleanText
+        : cleanText;
       const artifact = spec ? generateArtifact(spec) : undefined;
 
       let newBalance = balance;
diff --git a/packages/archioffice-agents/src/server/systemPrompts.ts b/packages/archioffice-agents/src/server/systemPrompts.ts
index 66b6343..aecd984 100644
--- a/packages/archioffice-agents/src/server/systemPrompts.ts
+++ b/packages/archioffice-agents/src/server/systemPrompts.ts
@@ -1,4 +1,5 @@
 import type { AgentRow, AgentContext } from '../types.js';
+import { describeAuthorizedResources } from './tools.js';
 
 export function buildAgentSystemPrompt(agent: AgentRow, ctx: AgentContext): string {
   if (agent.system_prompt_override) {
@@ -33,6 +34,21 @@ export function buildAgentSystemPrompt(agent: AgentRow, ctx: AgentContext): stri
       ctx.documentContents.map(d => `\n--- ${d.name} ---\n${d.content}\n---`).join('\n')
     : '';
 
+  const actionScopes = agent.action_scopes || [];
+  const canAct = actionScopes.length > 0;
+  const resourceSchema = describeAuthorizedResources(actionScopes);
+  const actionsSection = canAct
+    ? `\n═══ SCHÉMA DES RESSOURCES AUTORISÉES ═══
+Tu peux utiliser create_record / update_record / delete_record sur les ressources suivantes (champs suivis d'un * = obligatoires) :
+${resourceSchema}
+
+Règles :
+1. Une action de création ou modification doit toujours être suivie d'une confirmation claire à l'utilisateur (quoi, sur quelle ressource, avec quel identifiant/référence si connu).
+2. Ne prétends jamais avoir créé/modifié/supprimé quelque chose sans avoir réellement appelé l'outil correspondant.
+3. Ne supprime (delete_record) que sur demande explicite et non ambiguë portant sur un enregistrement précis.
+4. Si une ressource nécessaire n'est pas dans la liste ci-dessus, dis-le à l'utilisateur au lieu d'improviser.\n`
+    : '';
+
   return `Tu es ${agent.name}, ${agent.role_title} du cabinet d'architecture "${ctx.tenantName}".
 Date du jour : ${ctx.currentDate}.
 Tu réponds à : ${ctx.currentUserName}.
@@ -48,10 +64,12 @@ ${agent.directives || 'Être précis et factuel. Ne jamais inventer de données.
 ✓ Lire et analyser les documents joints à la conversation
 ✓ Générer des fichiers Excel, CSV ou Word à la demande
 ✓ Répondre aux questions métier de ton domaine d'expertise
-✗ Tu NE peux PAS créer, modifier ou supprimer des données en base
+${canAct
+  ? "✓ Créer, modifier ou supprimer des données dans les ressources listées ci-dessous (section SCHÉMA DES RESSOURCES AUTORISÉES), via les outils create_record / update_record / delete_record"
+  : "✗ Tu NE peux PAS créer, modifier ou supprimer de données — l'architecte n'a activé aucune permission d'écriture pour toi"}
 ✗ Tu NE peux PAS révéler de montants confidentiels
 ✗ Tu NE peux PAS prendre de décision à la place de l'architecte
-
+${actionsSection}
 ═══ GÉNÉRATION DE FICHIERS (ARTIFACTS) ═══
 Quand l'utilisateur demande un tableau, un planning, un rapport ou tout autre fichier structuré,
 génère-le en ajoutant un bloc artifact JSON à la fin de ta réponse, selon ce format :
diff --git a/packages/archioffice-agents/src/server/tools.ts b/packages/archioffice-agents/src/server/tools.ts
new file mode 100644
index 0000000..031d2d7
--- /dev/null
+++ b/packages/archioffice-agents/src/server/tools.ts
@@ -0,0 +1,179 @@
+import { AGENT_RESOURCES, type AgentResourceDef } from '../types.js';
+
+// ── Gemini function-calling tools — gated per agent by action_scopes ────────
+// Rather than hand-writing bespoke Supabase-write logic per resource (which
+// would duplicate — and drift from — the validation, id/reference
+// generation, and side effects already implemented in server.ts for every
+// human-facing form), these tools are generic (create_record / update_record
+// / delete_record) and execute by calling the app's own REST API over an
+// internal HTTP loopback, forwarding the caller's own auth token. An agent
+// action therefore always behaves exactly like a human submitting the same
+// form — same validation, same activity log entries, same everything.
+
+export interface FunctionDeclarationLike {
+  name: string;
+  description: string;
+  parametersJsonSchema: Record<string, unknown>;
+}
+
+export function buildAgentTools(actionScopes: string[]): FunctionDeclarationLike[] {
+  const authorized = AGENT_RESOURCES.filter(r => actionScopes.includes(r.key));
+  if (authorized.length === 0) return [];
+
+  const creatable = authorized.filter(r => r.create).map(r => r.key);
+  const updatable = authorized.filter(r => r.update).map(r => r.key);
+  const deletable = authorized.filter(r => r.delete).map(r => r.key);
+
+  const tools: FunctionDeclarationLike[] = [];
+
+  if (creatable.length > 0) {
+    tools.push({
+      name: 'create_record',
+      description:
+        "Crée un nouvel enregistrement dans une des ressources du cabinet auxquelles tu as accès en écriture. " +
+        "Consulte la section SCHÉMA DES RESSOURCES AUTORISÉES du prompt système pour connaître les champs attendus par ressource (les champs suivis d'un * sont obligatoires).",
+      parametersJsonSchema: {
+        type: 'object',
+        properties: {
+          resource: { type: 'string', enum: creatable, description: 'Type de ressource à créer' },
+          data: { type: 'object', description: "Champs de l'enregistrement, selon le schéma de la ressource" },
+        },
+        required: ['resource', 'data'],
+      },
+    });
+  }
+
+  if (updatable.length > 0) {
+    tools.push({
+      name: 'update_record',
+      description: "Met à jour un enregistrement existant. Seuls les champs fournis dans data sont modifiés, les autres restent inchangés.",
+      parametersJsonSchema: {
+        type: 'object',
+        properties: {
+          resource: { type: 'string', enum: updatable, description: 'Type de ressource à modifier' },
+          id: { type: 'string', description: "Identifiant de l'enregistrement à modifier" },
+          data: { type: 'object', description: 'Champs à mettre à jour' },
+        },
+        required: ['resource', 'id', 'data'],
+      },
+    });
+  }
+
+  if (deletable.length > 0) {
+    tools.push({
+      name: 'delete_record',
+      description:
+        "Supprime définitivement un enregistrement existant. Action IRRÉVERSIBLE : ne l'utilise que si l'utilisateur a demandé explicitement et sans ambiguïté la suppression de cet enregistrement précis dans le message en cours.",
+      parametersJsonSchema: {
+        type: 'object',
+        properties: {
+          resource: { type: 'string', enum: deletable, description: 'Type de ressource à supprimer' },
+          id: { type: 'string', description: "Identifiant de l'enregistrement à supprimer" },
+        },
+        required: ['resource', 'id'],
+      },
+    });
+  }
+
+  return tools;
+}
+
+export function describeAuthorizedResources(actionScopes: string[]): string {
+  const authorized = AGENT_RESOURCES.filter(r => actionScopes.includes(r.key));
+  if (authorized.length === 0) return '';
+  return authorized
+    .map(r => {
+      const ops = [r.create && 'créer', r.update && 'modifier', r.delete && 'supprimer'].filter(Boolean).join(', ');
+      return `- ${r.label} (resource: "${r.key}") — actions autorisées : ${ops}. Champs : ${r.fields}`;
+    })
+    .join('\n');
+}
+
+export interface AgentActionCall {
+  name?: string;
+  args?: Record<string, unknown>;
+}
+
+export interface AgentActionResult {
+  response: Record<string, unknown>;
+  summary?: string;
+}
+
+function deriveRecordLabel(data?: Record<string, unknown>): string {
+  if (!data) return '';
+  const candidates = ['title', 'name', 'os_number', 'entreprise_nom', 'numero', 'reference'];
+  for (const key of candidates) {
+    if (data[key]) return String(data[key]);
+  }
+  if (data.first_name || data.last_name) return `${data.first_name || ''} ${data.last_name || ''}`.trim();
+  return '';
+}
+
+export async function executeAgentAction(
+  baseUrl: string,
+  authHeader: string | undefined,
+  actionScopes: string[],
+  call: AgentActionCall
+): Promise<AgentActionResult> {
+  const name = call.name;
+  const args = call.args || {};
+  const resourceKey = String(args.resource || '');
+  const resource: AgentResourceDef | undefined = AGENT_RESOURCES.find(r => r.key === resourceKey);
+
+  if (!resource || !actionScopes.includes(resourceKey)) {
+    return { response: { error: `Ressource "${resourceKey}" non autorisée pour cet agent.` } };
+  }
+  if (!authHeader) {
+    return { response: { error: 'Session non authentifiée — action impossible.' } };
+  }
+
+  let method: 'POST' | 'PUT' | 'DELETE';
+  let path = resource.basePath;
+  let body: Record<string, unknown> | undefined;
+
+  if (name === 'create_record') {
+    if (!resource.create) return { response: { error: `Création non supportée pour "${resourceKey}".` } };
+    method = 'POST';
+    body = (args.data as Record<string, unknown>) || {};
+  } else if (name === 'update_record') {
+    if (!resource.update) return { response: { error: `Modification non supportée pour "${resourceKey}".` } };
+    const id = String(args.id || '');
+    if (!id) return { response: { error: 'id est requis pour une modification.' } };
+    method = 'PUT';
+    path = `${resource.basePath}/${encodeURIComponent(id)}`;
+    body = (args.data as Record<string, unknown>) || {};
+  } else if (name === 'delete_record') {
+    if (!resource.delete) return { response: { error: `Suppression non supportée pour "${resourceKey}".` } };
+    const id = String(args.id || '');
+    if (!id) return { response: { error: 'id est requis pour une suppression.' } };
+    method = 'DELETE';
+    path = `${resource.basePath}/${encodeURIComponent(id)}`;
+  } else {
+    return { response: { error: `Fonction inconnue : ${name}` } };
+  }
+
+  try {
+    const res = await fetch(baseUrl + path, {
+      method,
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: authHeader,
+      },
+      body: method === 'DELETE' ? undefined : JSON.stringify(body),
+    });
+
+    const json: any = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      return { response: { error: json?.error || `Échec de l'opération (HTTP ${res.status}).` } };
+    }
+
+    const verb = name === 'create_record' ? 'créé' : name === 'update_record' ? 'modifié' : 'supprimé';
+    const label = name === 'delete_record' ? String(args.id) : deriveRecordLabel(body) || json?.id || '';
+    return {
+      response: { success: true, ...json },
+      summary: `${resource.label} ${verb}${label ? ` : ${label}` : ''}`,
+    };
+  } catch (e: any) {
+    return { response: { error: e?.message || "Erreur inconnue lors de l'exécution de l'action." } };
+  }
+}
diff --git a/packages/archioffice-agents/src/types.ts b/packages/archioffice-agents/src/types.ts
index ee904bb..362653c 100644
--- a/packages/archioffice-agents/src/types.ts
+++ b/packages/archioffice-agents/src/types.ts
@@ -2,6 +2,59 @@
 
 export type AgentContextScope = 'meetings' | 'contacts' | 'projects' | 'documents' | 'tasks';
 
+// Write permissions — separate from context_scopes (read-only) so an agent
+// can be given data access without automatically being able to write.
+// One scope = one resource = the same create/update/delete surface a human
+// has in that section of the app, exposed to the agent via the app's own
+// REST API (see server/tools.ts) so behavior always matches the UI exactly.
+export type AgentActionScope = string;
+
+export interface AgentResourceDef {
+  key: string;
+  label: string;
+  basePath: string;
+  create: boolean;
+  update: boolean;
+  delete: boolean;
+  /** Human-readable field hint injected into the agent's system prompt. */
+  fields: string;
+}
+
+export const AGENT_RESOURCES: AgentResourceDef[] = [
+  { key: 'contacts', label: 'Contacts', basePath: '/api/contacts', create: true, update: true, delete: true,
+    fields: 'first_name*, last_name*, company_name, email, phone, category, address, city, zip, notes' },
+  { key: 'proposals', label: 'Devis', basePath: '/api/proposals', create: true, update: true, delete: false,
+    fields: 'title*, client_id*, amount, status (Draft/Sent/Accepted/Rejected), description' },
+  { key: 'projects', label: 'Projets', basePath: '/api/projects', create: true, update: true, delete: true,
+    fields: 'name*, client*, status*, client_id, budget, category, start_date, end_date, description, address' },
+  { key: 'tenders', label: "Appels d'offres", basePath: '/api/tenders', create: true, update: true, delete: true,
+    fields: 'title*, client*, submission_deadline*, status*, description, amount' },
+  { key: 'invoices', label: 'Factures', basePath: '/api/invoices', create: true, update: true, delete: false,
+    fields: 'status* (Draft/Sent/Paid/Overdue), title, project_id, client_id, amount, due_date' },
+  { key: 'specifications', label: 'CCTP', basePath: '/api/specifications', create: true, update: true, delete: true,
+    fields: 'title*, project_id, description, content' },
+  { key: 'tasks', label: 'Tâches', basePath: '/api/tasks', create: true, update: true, delete: true,
+    fields: 'title*, start_date*, end_date*, project_id, status, description' },
+  { key: 'milestones', label: 'Jalons', basePath: '/api/milestones', create: true, update: true, delete: true,
+    fields: 'title*, due_date*, project_id, status' },
+  { key: 'meetings', label: 'Réunions', basePath: '/api/meetings', create: true, update: true, delete: true,
+    fields: "title*, date*, type (projet/visite_candidature/visite_proposition), project_id, notes" },
+  { key: 'contrats_moe', label: 'Contrats MOE', basePath: '/api/contrats_moe', create: true, update: true, delete: true,
+    fields: 'client_id, project_id, type_contrat, type_moa, montant_honoraires, intitule_projet' },
+  { key: 'ordres_de_service', label: 'Ordres de service', basePath: '/api/ordres_de_service', create: true, update: true, delete: true,
+    fields: 'os_number*, title*, date*, project_id' },
+  { key: 'visas', label: 'Visas', basePath: '/api/visas', create: true, update: true, delete: true,
+    fields: 'title*, date*, project_id' },
+  { key: 'receptions', label: 'Réceptions', basePath: '/api/receptions', create: true, update: true, delete: true,
+    fields: 'date*, type*, project_id' },
+  { key: 'reserves', label: 'Réserves', basePath: '/api/reserves', create: true, update: true, delete: true,
+    fields: 'title*, project_id' },
+  { key: 'marches_entreprises', label: 'Marchés entreprises', basePath: '/api/marches-entreprises', create: true, update: true, delete: true,
+    fields: 'project_id*, entreprise_nom*, lot_numero, lot_titre, montant_ht' },
+  { key: 'notes_honoraires', label: "Notes d'honoraires", basePath: '/api/notes_honoraires', create: true, update: true, delete: true,
+    fields: 'project_id, contrat_id, numero, date, objet, montant_ht' },
+];
+
 export interface Agent {
   id: string;
   tenant_id: string | null;
@@ -14,6 +67,7 @@ export interface Agent {
   directives?: string;
   system_prompt_override?: string;
   context_scopes: AgentContextScope[];
+  action_scopes: AgentActionScope[];
   is_active: boolean;
   is_system_template: boolean;
   created_at: string;
@@ -77,6 +131,7 @@ export interface AgentRow {
   directives?: string;
   system_prompt_override?: string;
   context_scopes: string[];
+  action_scopes: string[];
   is_active: boolean;
   is_system_template: boolean;
 }
diff --git a/server.ts b/server.ts
index 53a70d9..52edfd6 100644
--- a/server.ts
+++ b/server.ts
@@ -4354,7 +4354,9 @@ async function startServer() {
   };
 
   const getUserName = async (tenantId: string, userId: string, email?: string): Promise<string> => {
-    const { data: me } = await supabaseAdmin.from('team_members').select('name').eq('user_id', userId).eq('tenant_id', tenantId).maybeSingle();
+    // profiles is the live source of truth for a user's display name — team_members
+    // is no longer written to anywhere (POST/PUT /api/team both write to profiles).
+    const { data: me } = await supabaseAdmin.from('profiles').select('name').eq('id', userId).eq('tenant_id', tenantId).maybeSingle();
     return (me as any)?.name || email?.split('@')[0] || 'Utilisateur';
   };
 
@@ -4397,7 +4399,7 @@ async function startServer() {
       const [{ data: acts, error: actsError }, { data: posts, error: postsError }, { data: member }] = await Promise.all([
         supabaseAdmin.from('activities').select('*').eq('tenant_id', tenantId).order('created_at', { ascending: false }).limit(50),
         supabaseAdmin.from('feed_posts').select('*').eq('tenant_id', tenantId).order('created_at', { ascending: false }).limit(50),
-        supabaseAdmin.from('team_members').select('notifications_last_seen').eq('user_id', req.user.id).eq('tenant_id', tenantId).maybeSingle()
+        supabaseAdmin.from('team_members').select('notifications_last_seen').eq('auth_user_id', req.user.id).eq('tenant_id', tenantId).maybeSingle()
       ]);
       if (actsError) console.error('[GET /api/feed] activities query failed:', actsError);
       if (postsError) console.error('[GET /api/feed] feed_posts query failed:', postsError);
@@ -4586,7 +4588,7 @@ async function startServer() {
   app.get("/api/notifications/unread-count", async (req: any, res: any) => {
     try {
       const tenantId = await getTenantId(req.user.id);
-      const { data: member } = await supabaseAdmin.from('team_members').select('notifications_last_seen').eq('user_id', req.user.id).eq('tenant_id', tenantId).maybeSingle();
+      const { data: member } = await supabaseAdmin.from('team_members').select('notifications_last_seen').eq('auth_user_id', req.user.id).eq('tenant_id', tenantId).maybeSingle();
       const lastSeen = (member as any)?.notifications_last_seen || new Date(0).toISOString();
 
       const [{ count: actCount }, { count: postCount }] = await Promise.all([
@@ -4604,7 +4606,7 @@ async function startServer() {
     try {
       const tenantId = await getTenantId(req.user.id);
       const now = new Date().toISOString();
-      await supabaseAdmin.from('team_members').update({ notifications_last_seen: now }).eq('user_id', req.user.id).eq('tenant_id', tenantId);
+      await supabaseAdmin.from('team_members').update({ notifications_last_seen: now }).eq('auth_user_id', req.user.id).eq('tenant_id', tenantId);
       res.json({ success: true, last_seen: now });
     } catch (err: any) {
       res.status(500).json({ error: "Failed to mark notifications as read" });
@@ -8800,6 +8802,7 @@ Réponds UNIQUEMENT avec un tableau JSON valide (sans markdown, sans explication
     deductAiCredit,
     maybeRefreshMonthlyCredits,
     PLAN_AI_MONTHLY_CREDIT_CENTS,
+    baseUrl: `http://127.0.0.1:${PORT}`,
   });
 
 
diff --git a/src/App.tsx b/src/App.tsx
index e1f7d5f..3d1504f 100644
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -13,7 +13,7 @@ import {
   IconMessageCircle,
   IconUser,
 } from '@tabler/icons-react';
-import { ArchiOfficeLogo } from './components/ArchiOfficeLogo';
+import { BrandLogo } from './components/ArchiOfficeLogo';
 import { UpdateBanner } from './components/UpdateBanner';
 import { useState, useEffect, useRef, lazy, Suspense } from 'react';
 import { motion, AnimatePresence } from 'motion/react';
@@ -25,6 +25,7 @@ import { Sidebar, NAV_ITEMS } from './components/Sidebar';
 import { apiFetch } from './lib/api';
 import { isOfflineBuild } from './lib/authToken';
 import { getSyncStatus, triggerSyncNow, SyncStatusResponse } from './lib/cloudSync';
+import { useSettings } from './hooks/useSettings';
 
 // Pages — lazy-loaded so each route's JS is only fetched when it's visited,
 // instead of every page (ProjectDetail alone is ~270KB) landing in one
@@ -164,6 +165,7 @@ function Header() {
   const { t } = useTranslation();
   const { theme, setTheme } = useTheme();
   const { currentUser, headerTitle, setHeaderTitle, signOut } = useUser();
+  const { settings } = useSettings();
   const location = useLocation();
   const navigate = useNavigate();
   const [isUserMenuOpen, setIsUserMenuOpen] = useState(false);
@@ -296,7 +298,7 @@ function Header() {
             className="md:hidden flex items-center gap-2 font-bold text-sm"
             style={{ color: 'var(--tblr-text)' }}
           >
-            <ArchiOfficeLogo size={24} />
+            <BrandLogo logoUrl={settings?.logoUrl} size={24} />
             ArchiOffice
           </Link>
           <h1
@@ -594,7 +596,7 @@ function Header() {
                 className="flex items-center gap-2.5 px-4 py-4 border-b shrink-0"
                 style={{ borderColor: 'var(--tblr-border)' }}
               >
-                <ArchiOfficeLogo size={28} />
+                <BrandLogo logoUrl={settings?.logoUrl} size={28} />
                 <span className="font-bold text-sm" style={{ color: 'var(--tblr-text)' }}>ArchiOffice</span>
               </div>
               {/* Nav items */}
diff --git a/src/components/ArchiOfficeLogo.tsx b/src/components/ArchiOfficeLogo.tsx
index a558496..608189a 100644
--- a/src/components/ArchiOfficeLogo.tsx
+++ b/src/components/ArchiOfficeLogo.tsx
@@ -30,3 +30,24 @@ export function ArchiOfficeLogo({ className, size = 32 }: ArchiOfficeLogoProps)
     </svg>
   );
 }
+
+interface BrandLogoProps {
+  logoUrl?: string | null;
+  className?: string;
+  size?: number;
+}
+
+/** Tenant logo when one has been uploaded, resized to the same height as the default mark; falls back to the ArchiOffice mark otherwise. */
+export function BrandLogo({ logoUrl, className, size = 32 }: BrandLogoProps) {
+  if (logoUrl) {
+    return (
+      <img
+        src={logoUrl}
+        alt="Logo"
+        className={className}
+        style={{ height: size, width: 'auto', maxWidth: size * 3.5, objectFit: 'contain' }}
+      />
+    );
+  }
+  return <ArchiOfficeLogo className={className} size={size} />;
+}
diff --git a/src/components/ContactModal.tsx b/src/components/ContactModal.tsx
index f5bf9d2..a38eb42 100644
--- a/src/components/ContactModal.tsx
+++ b/src/components/ContactModal.tsx
@@ -1,9 +1,9 @@
 import React, { useState, FormEvent } from 'react';
 import { motion } from 'motion/react';
 import { useTranslation } from 'react-i18next';
-import { IconMail, IconPhone, IconPlus } from '@tabler/icons-react';
+import { IconMail, IconPhone, IconAlertTriangle } from '@tabler/icons-react';
 import type { Contact } from '../types';
-import { fetchJson } from '../lib/api';
+import { apiFetch } from '../lib/api';
 
 interface ContactModalProps {
   isOpen: boolean;
@@ -18,6 +18,7 @@ export function ContactModal({ isOpen, onClose, onSuccess, initialCategory }: Co
     category: initialCategory || ''
   });
   const [isSubmitting, setIsSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
 
   const defaultContact: Contact = {
     id: '',
@@ -77,8 +78,9 @@ export function ContactModal({ isOpen, onClose, onSuccess, initialCategory }: Co
 
   const handleSubmit = async (e: FormEvent) => {
     e.preventDefault();
+    setError(null);
     setIsSubmitting(true);
-    
+
     const contactData = {
       ...newContact,
       id: `c${Date.now()}-${Math.random()}`,
@@ -104,24 +106,13 @@ export function ContactModal({ isOpen, onClose, onSuccess, initialCategory }: Co
     };
 
     try {
-      const res = await fetch('/api/contacts', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(contact)
-      });
-      
-      if (res.ok) {
-        onSuccess(contact);
-        onClose();
-        setNewContact({ category: initialCategory || '' });
-      } else {
-        const errorData = await res.json();
-        console.error('Failed to save contact:', errorData);
-        alert(`Failed to save contact: ${errorData.error || 'Unknown error'}`);
-      }
-    } catch (err) {
+      await apiFetch('/api/contacts', { method: 'POST', body: JSON.stringify(contact) });
+      onSuccess(contact);
+      onClose();
+      setNewContact({ category: initialCategory || '' });
+    } catch (err: any) {
       console.error('Error submitting contact:', err);
-      alert('Failed to save contact. Please check the console for details.');
+      setError(err?.message || 'Échec de la sauvegarde du contact.');
     } finally {
       setIsSubmitting(false);
     }
@@ -147,6 +138,12 @@ export function ContactModal({ isOpen, onClose, onSuccess, initialCategory }: Co
             ✕
           </button>
         </div>
+        {error && (
+          <div className="mx-6 mt-4 px-3 py-2 rounded-lg border text-sm flex items-center gap-2 bg-red-50 dark:bg-red-900/20 border-red-200 dark:border-red-800 text-red-700 dark:text-red-400">
+            <IconAlertTriangle size={16} className="shrink-0" />
+            {error}
+          </div>
+        )}
         <form onSubmit={handleSubmit} className="p-6 space-y-8">
           {/* Identité Section */}
           <div className="space-y-4">
diff --git a/src/components/Sidebar.tsx b/src/components/Sidebar.tsx
index 6d479f6..ded0d8d 100644
--- a/src/components/Sidebar.tsx
+++ b/src/components/Sidebar.tsx
@@ -29,7 +29,7 @@ import {
   IconCloudUpload,
   IconBuildingBank,
 } from '@tabler/icons-react';
-import { ArchiOfficeLogo } from './ArchiOfficeLogo';
+import { BrandLogo } from './ArchiOfficeLogo';
 import { useUser } from '../UserContext';
 import { useSettings } from '../hooks/useSettings';
 import { apiFetch } from '../lib/api';
@@ -172,7 +172,7 @@ export function Sidebar() {
           className="flex items-center gap-2 font-bold text-base tracking-tight"
           style={{ color: 'var(--tblr-text)' }}
         >
-          <ArchiOfficeLogo size={28} />
+          <BrandLogo logoUrl={settings?.logoUrl} size={28} />
           <span>ArchiOffice</span>
         </Link>
         {settings?.agencyName && (
diff --git a/src/locales/fr.ts b/src/locales/fr.ts
index cc8fc35..5524034 100644
--- a/src/locales/fr.ts
+++ b/src/locales/fr.ts
@@ -663,6 +663,10 @@ export default {
       "agent_config_identity": "Identité",
       "agent_config_directives": "Directives",
       "agent_config_scopes": "Accès aux données",
+      "agent_config_actions": "Actions autorisées",
+      "agent_config_actions_hint": "Chaque ressource cochée donne à l'agent le droit de créer, modifier et supprimer des données à cet endroit, exactement comme un humain avec accès à cette section. À activer uniquement pour les agents de confiance.",
+      "agent_config_actions_select_all": "Tout activer",
+      "agent_config_actions_clear_all": "Tout désactiver",
       "agent_config_prompt": "Prompt avancé",
       "agent_config_prompt_hint": "Laisser vide pour utiliser le prompt généré automatiquement",
       "agent_config_save": "Enregistrer",
diff --git a/src/pages/Contacts.tsx b/src/pages/Contacts.tsx
index 8f39765..c72a98d 100644
--- a/src/pages/Contacts.tsx
+++ b/src/pages/Contacts.tsx
@@ -169,30 +169,16 @@ export default function Contacts() {
       const url = isEditing ? `/api/contacts/${editingId}` : '/api/contacts';
       const method = isEditing ? 'PUT' : 'POST';
 
-      const res = await fetch(url, {
-        method,
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(contact)
-      });
+      await apiFetch(url, { method, body: JSON.stringify(contact) });
 
-      if (res.ok) {
-        setIsModalOpen(false);
-        setIsEditing(false);
-        setEditingId(null);
-        setNewContact({});
-        fetchContacts();
-      } else {
-        const text = await res.text();
-        try {
-          const errorData = JSON.parse(text);
-          console.error('Failed to save contact:', errorData);
-          alert(`Failed to save contact: ${errorData.error || 'Unknown error'}`);
-        } catch (e) {
-          console.error('Failed to save contact (non-JSON response):', text);
-          alert(`Failed to save contact: Server returned ${res.status} ${res.statusText}`);
-        }
-      }
+      setIsModalOpen(false);
+      setIsEditing(false);
+      setEditingId(null);
+      setNewContact({});
+      fetchContacts();
+      showToast(isEditing ? 'Contact modifié' : 'Contact créé');
     } catch (err: any) {
+      console.error('Failed to save contact:', err);
       showToast(err?.message || 'Erreur lors de la sauvegarde du contact', 'error');
     }
   };
@@ -315,6 +301,7 @@ export default function Contacts() {
 
     const handleConfirm = async () => {
       if (!importData) return;
+      let failed = 0;
       for (const row of importData.data) {
         const contact: Contact = {
           ...defaultContact,
@@ -338,15 +325,20 @@ export default function Contacts() {
         contact.country = contact.address_work_country || '';
         contact.ca_amount = Number(contact.ca_amount) || 0;
 
-        await fetch('/api/contacts', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify(contact)
-        });
+        try {
+          await apiFetch('/api/contacts', { method: 'POST', body: JSON.stringify(contact) });
+        } catch (err) {
+          console.error('Failed to import contact:', err);
+          failed++;
+        }
       }
       fetchContacts();
       setIsMappingModalOpen(false);
       setImportData(null);
+      showToast(
+        failed > 0 ? `Import terminé avec ${failed} échec(s)` : 'Import terminé',
+        failed > 0 ? 'error' : 'success'
+      );
     };
 
     if (!isMappingModalOpen || !importData) return null;
diff --git a/supabase/migrate_add_agent_actions.sql b/supabase/migrate_add_agent_actions.sql
new file mode 100644
index 0000000..39114f6
--- /dev/null
+++ b/supabase/migrate_add_agent_actions.sql
@@ -0,0 +1,9 @@
+-- ============================================================
+-- ArchiOffice — Migration : Actions d'écriture pour les Agents IA
+-- ============================================================
+-- Les agents ne pouvaient jusqu'ici que lire les données du cabinet
+-- (context_scopes). Cette colonne leur donne, agent par agent et sur
+-- décision explicite de l'architecte, la permission de créer des
+-- données (contacts, devis) via des function calls Gemini.
+
+ALTER TABLE agents ADD COLUMN IF NOT EXISTS action_scopes TEXT[] NOT NULL DEFAULT '{}';
diff --git a/supabase/migrate_add_team_members_auth_user_id.sql b/supabase/migrate_add_team_members_auth_user_id.sql
new file mode 100644
index 0000000..6586e95
--- /dev/null
+++ b/supabase/migrate_add_team_members_auth_user_id.sql
@@ -0,0 +1,17 @@
+-- ============================================================
+-- ArchiOffice — Migration : team_members.auth_user_id
+-- ============================================================
+-- server.ts looks up the current user's team_members row (display name,
+-- notifications_last_seen) by their Supabase Auth id. That lookup was
+-- filtering on a `user_id` column that was never actually created by any
+-- committed migration — team_members.id is the row's own primary key, not
+-- the auth id, so every call to getUserName()/the notifications endpoints
+-- failed with "column team_members.user_id does not exist" (visible in
+-- production logs on every activity-logging call, e.g. right after
+-- creating a contact — the insert itself succeeded, but the follow-up
+-- getUserName() call then threw, turning the whole request into a 500).
+-- This column formalizes the auth-id link so lookups succeed.
+
+ALTER TABLE team_members ADD COLUMN IF NOT EXISTS auth_user_id TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_team_members_auth_user ON team_members(auth_user_id, tenant_id);