Autonomy & Approvals

Every Internal agent has an autonomy level — a single per-agent dial that controls how often the agent pauses to ask for your approval before acting. It’s the trade-off between control (you review before things happen) and speed (the agent just gets it done).

Set it in: the agent’s Autonomy section. Higher autonomy means fewer interruptions; lower autonomy means the agent checks in before planning and before sensitive actions.

The autonomy dial

The dial ranges from cautious to fully hands-off. As you raise it, the agent asks for approval less often.

There are four positions, and these are the names you’ll see in the agent’s Autonomy section:

Co-pilot

Ask before every change, including edits inside the agent’s own sandbox.

Supervised

Also ask before external writes and changes to your own machine.

Guarded

Ask for destructive and sensitive actions.

Autopilot

No approvals — except payments and credentials, which always stop for you. The default, and recommended for most agents.

A new agent starts on Autopilot. A few templates whose work deploys, changes databases or writes to your customers about money start on Supervised. In a chat, the autonomy control next to the send button changes the level for that conversation only. Loops, schedules, webhooks and API runs use the agent’s level, and a new chat starts from it.

When the agent pauses, you get an approval card in the workspace (and on supported channels). Approve the action, reject it with a note on what to do instead, or, where the card offers it, choose Always allow. The agent resumes from where it stopped.

Plan approval

A key part of autonomy is when the agent shows you its plan before doing the work:

The agent writes a plan document — a goal, an approach, numbered steps, its assumptions, and any open questions it wants answered. Each step shows what it will actually do, and which steps will need your approval when they run.

Whether that plan waits for you depends on your autonomy level and on what the steps declare they will do, not on how the request was phrased:

Level	When the plan waits for approval
Co-pilot	Always.
Supervised	When any step writes, sends, deletes or spends.
Guarded	When any step is destructive, or touches payments or credentials.
Autopilot	Never. Sensitive actions still stop for you when they run.

To see a plan before the work starts, pick Supervised or Co-pilot for that chat.

When a plan is waiting you can approve it with Run plan, ask for changes, answer its open questions, or edit the plan yourself before approving. Approving a plan also pre-approves the ordinary steps in it, so the agent does not stop again for each one — with the deliberate exception of destructive and sensitive steps, which always ask again at the moment they run.

A second model checks risky actions

At Autopilot and Guarded, a separate reviewer model looks at each write or destructive action before it runs, together with your original request and the approved plan. It decides one of three things: the action is clearly within what you asked for and proceeds, it is unclear or goes beyond your request and comes to you instead, or it is clearly harmful and is refused.

This makes the autonomy levels read your intent rather than just an action’s category. Asking for a research summary and having the agent email a stranger it found mid-research is the kind of thing it is there to catch.

Two things are worth knowing:

It never relaxes the safety floor. Payments and credentials always come to you, whatever your level.
When it is unsure, you are asked. If the reviewer times out or fails, the request escalates to you rather than proceeding. And if it interrupts you repeatedly in one run, it stands down for the rest of that run.

Every decision it makes is recorded with the action it decided on.

Approval rules

You can set rules per agent, by action pattern, that override the dial:

Rule	Effect
Always allow	That action never asks.
Must ask	That action always asks, even at full autonomy.
Never	That action is refused outright.

“Never” wins over everything, including full autonomy. Nothing you set here loosens the safety floor for payments and credentials.

Some abilities offered by an Integration are marked by the service itself as needing a person. Those always ask, at every level, with no option to remember your answer — and where there is nobody to ask, such as a scheduled Loop or a customer conversation, they are refused rather than auto-approved.

Organization-wide rules

An organization owner can set rules and a minimum approval level that apply to every agent at once, so an individual agent can be made more cautious than the organization’s floor but never less. See Organization governance.

During a voice call

If a background task stops to ask you something while you are on a voice call with your agent, the request appears in the workspace chat. Answer it there: approvals are not taken out loud.

Approvals persist

Approval requests are durable. If you’re not at your desk when the agent pauses, the request waits for up to three days — you can approve it later from the workspace, and the agent picks up exactly where it left off. This works for long-running and background tasks too. An approval nobody answers within three days counts as rejected, and the agent finishes by reporting what it could not do.

Choosing a level

Customer-facing Agents — without hand-off, these never wait for an approval, because nobody in a customer conversation can give one. At every level they can send an email, add a calendar event and create a ticket or an issue when that ability is ticked on the Integration and none of your rules blocks it. Without hand-off, any other change is refused. To stop one of those actions, untick it on the Integration. On a website, the ability must also be allowed on the website’s page, and the visitor confirms it before it runs (see Website channel). On Pro and up with hand-off on, other changes go to your team for approval instead, except abilities that always ask, sensitive actions such as refunds and payments, and anything on a phone call (see Actions that need approval).
Internal automation — raise autonomy for repetitive, well-understood jobs where interruptions slow you down.
High-stakes actions — on an internal Agent, keep approvals on for anything that spends money, emails customers, or deletes records.