How approvals work

Every action an agent takes falls into one of three tiers:

• Routine — runs immediately. Reading your calendar, searching a repo, drafting a reply, summarizing a thread. Read-only and internal work has no approval friction.
• Gated — waits for you. Anything that acts on the outside world under your identity — sending an email, posting a message, creating a record — is held until you approve or reject it.
• Never autonomous — always you. The highest-risk category — reaching people outside your team, or moving money — is never allowed to run on its own, even on a schedule. A person has to trigger it.

When a gated action is queued, it lands in your inbox with a plain-language preview of exactly what will happen — the recipient, subject, and body of an email; the channel and text of a message — not a wall of raw JSON. You see the real thing before it goes anywhere.

Background runs never stall waiting on you: the run finishes the rest of its work, and only the gated step sits in your inbox. Each pending item shows how long you have to decide before it expires.

You don’t have to accept an action exactly as proposed. Open it and choose Edit before approving to change what will be sent — tighten the wording of a message, fix a draft email’s body, adjust an automation’s instructions — then save and approve. Approving runs your edited version. No more rejecting a nearly-right action just to have it done again. Editing only ever changes the content of the action, never which tool runs — so it can’t slip past the approval it’s under.

Approving executes the action right then, under the owning agent’s connected account, and records the result. Rejecting stops it from running at all — and when the run is still live, the agent takes your rejection as feedback and adjusts, rather than blindly retrying the same thing.

Approving the same routine tool over and over gets old. From an approval you can allow a whole toolkit’s safe tools to run without asking — routine Gmail actions, say — while the highest-risk actions still always require your explicit approval. You decide how much friction you want.

Every approval decision — who approved or rejected it, and when — is logged, and the outcome of an approved action lands back on that run’s page so you can see what actually happened. Nothing an agent does on your behalf is invisible.

Putting a task on a schedule or an event trigger doesn’t loosen any of this. A scheduled run and a run-now use the same risk tiers, the same approval inbox, and the same credit metering. Automation changes when an agent acts — never what it’s allowed to do.