Approvals

The core rule of the entire platform: agents propose, humans approve. No agent pauses, escalates, or autonomously changes anything that costs money or acts outward — it puts forward a proposal with visible scope, and a human decides.

When approval is mandatory

Approval is always required when an action is live and has at least one of these effects:

• Paid — consumes credits or an external, paid provider.
• Externally visible — leaves the workspace: an email or LinkedIn send, a CRM write, an import that creates leads.
• Structure-changing — creates a new table/column, changes a playbook, pins a new asset version.

A dry run never needs approval — it only shows what would happen. Pure read access (status, evaluation) doesn’t either.

The feed

Every pending approval shows up in the feed as an open Run: scope, affected rows, cost cap, a link to the detail view. You see exactly what approving would trigger before you do it — not after.

Why this rule is a rule, not a special case

Every new capability in the system — a new column type, a new workflow type, a new integration category — computes its approval requirement from the same formula (mode × effect), instead of bringing its own check. That prevents the gap that opens up when approval is only built into one of several execution paths.

See also: Costs for the cost cap that bounds every live run.