Autonomy & approvals

You decide how independently the agent works. This page explains the trust model in practice: 4 autonomy levels, per-tool risk, allow-lists and the approval-card flow.

4 autonomy levels

Level	Runs automatically	Requires approval
Supervised (default)	Read/draft only (safe)	Every write/send
Low trust	Up to low risk	Medium and above
High trust	Up to medium risk	High/critical
Autonomous	All	Only the "never silent" class

Risk is computed per tool + arguments: the same tool can carry different risk against a different target. "Never silent" actions never run without approval at any level (e.g. publishing to social media). For each tool's risk class: tool reference.

Allow-lists

• Email domains: the agent can only send to domains on the list (*.yourcompany.com is supported).
• HTTP/egress targets: url_fetch and http_request only reach permitted domains.
• These are enforced at the code level — even if external content tricks the agent, it can't step off the list.

Approval-card flow

1. When the agent reaches a risky step, an approval card appears in chat: what it will do, the target, the content.
2. "Approve" → continues; "Edit" → continues with your change. Other independent steps don't stop while it waits.
3. After approval the answer returns to chat; all decisions and actions are logged.