Co-pilot
Ask before every change, including edits inside the agent’s own sandbox.
Autonomy & Approvals
Autonomy & Approvals
Section titled “Autonomy & Approvals”Every agent has an autonomy level — a single per-agent dial that controls how often the agent pauses to ask for your approval before acting. It’s the trade-off between control (you review before things happen) and speed (the agent just gets it done).
Set it in: Agent → Settings → Autonomy. Higher autonomy means fewer interruptions; lower autonomy means the agent checks in before planning and before sensitive actions.
The autonomy dial
Section titled “The autonomy dial”The dial ranges from cautious to fully hands-off. As you raise it, the agent asks for approval less often.
There are four positions, and these are the names you’ll see in Agent → Settings → Autonomy:
Supervised
Also ask before external writes and changes to your own machine.
Guarded
Ask for destructive and sensitive actions. Recommended for most agents.
Autopilot
No approvals — except payments and credentials, which always stop for you.
When the agent pauses, you get an approval prompt in the workspace (and on supported channels). Approve, reject, or edit — the agent resumes from where it stopped.
Plan approval
Section titled “Plan approval”A key part of autonomy is when the agent shows you its plan before doing the work:
The agent writes a plan document — a goal, an approach, numbered steps, its assumptions, and any open questions it wants answered. Each step shows what it will actually do, and which steps will need your approval when they run.
Whether that plan waits for you depends on your autonomy level and on what the steps declare they will do, not on how the request was phrased:
| Level | When the plan waits for approval |
|---|---|
| Co-pilot | Always. |
| Supervised | When any step writes, sends, deletes or spends. |
| Guarded | When any step is destructive, or touches payments or credentials. |
| Autopilot | Never — but sensitive actions still stop for you when they run. |
You can also turn on Plan first for a single conversation, from the autonomy control in the composer, when you want to see the plan for one piece of work without changing the agent’s setting.
When a plan is waiting you can approve it, ask for changes, answer its open questions, or edit the plan yourself before approving. Approving a plan also pre-approves the ordinary steps in it, so the agent does not stop again for each one — with the deliberate exception of destructive and sensitive steps, which always ask again at the moment they run.
A second model checks risky actions
Section titled “A second model checks risky actions”At Autopilot and Guarded, a separate reviewer model looks at each write or destructive action before it runs, together with your original request and the approved plan. It decides one of three things: the action is clearly within what you asked for and proceeds, it is unclear or goes beyond your request and comes to you instead, or it is clearly harmful and is refused.
This makes the autonomy levels read your intent rather than just an action’s category. Asking for a research summary and having the agent email a stranger it found mid-research is the kind of thing it is there to catch.
Two things are worth knowing:
- It never relaxes the safety floor. Payments, credentials and bulk destructive actions always come to you, whatever your level.
- When it is unsure, you are asked. If the reviewer times out or fails, the request escalates to you rather than proceeding. And if it interrupts you repeatedly in one run, it stands down for the rest of that run.
Every decision it makes is recorded in your approvals history, marked as automatic, so you can see what was approved on your behalf.
Approval rules
Section titled “Approval rules”You can set rules per agent, by action pattern, that override the dial:
| Rule | Effect |
|---|---|
| Always allow | That action never asks. |
| Must ask | That action always asks, even at full autonomy. |
| Never | That action is refused outright. |
“Never” wins over everything, including full autonomy. Nothing you set here loosens the safety floor for payments and credentials.
Some abilities offered by an Integration are marked by the service itself as needing a person. Those always ask, at every level, with no option to remember your answer — and where there is nobody to ask, such as a scheduled Flow or a customer conversation, they are refused rather than auto-approved.
Organization-wide rules
Section titled “Organization-wide rules”An organization owner can set rules and a minimum approval level that apply to every agent at once, so an individual agent can be made more cautious than the organization’s floor but never less. The same page can also have Auteryn notify your own systems at key moments in a run. See Organization governance.
Answering by voice
Section titled “Answering by voice”If you are on a live voice call with your agent and a background task stops to ask you something, you can answer out loud — the agent reads you the request and takes your answer. Actions that write, send or delete are read back to you with what they will do before you confirm.
On a phone call, write and destructive actions are not approvable by voice. The agent will tell you the request is waiting on your screen.
Approvals persist
Section titled “Approvals persist”Approval requests are durable. If you’re not at your desk when the agent pauses, the request waits — you can approve it later from the workspace, and the agent picks up exactly where it left off. This works for long-running and background tasks too.
Choosing a level
Section titled “Choosing a level”- Customer-facing and channel bots — keep autonomy tuned so the agent responds quickly, but require approval for actions that change data.
- Internal automation — raise autonomy for repetitive, well-understood jobs where interruptions slow you down.
- High-stakes actions — keep approvals on for anything that spends money, emails customers, or deletes records.