Approvals: humans approve, agents prepare

The rule that makes autonomy safe: agents prepare, humans approve. Some actions never happen without your explicit nod.

What you’ll learn

• Which actions are gated, and why.
• What you see when a run pauses for approval.
• How to streamline the common cases without lowering the bar.

The approval gate

When a worker tries a tool you’ve flagged — anything irreversible or destructive (sending an email, posting publicly, deleting, modifying production data) — the run pauses, drops the request into an approvals queue, and notifies you. You see exactly what it wants to do and approve or reject it.

1. A worker reaches a flagged step and stops.
2. The request appears on the worker’s profile with ✓ Approve / ✕ Reject, and a global banner flags pending items.
3. You read what it intends, then approve or reject. The same gate guards Plans — a plan waits in pending approval until you say go.

Streamline without weakening

You can say “always allow this worker to run this tool” for the safe, repetitive cases — without lowering the bar for the genuinely risky ones. For sensitive Routines you can even require several approvals in order (say Legal, then Finance, then CEO).

Nothing goes out silently

By default, sending an email or posting publicly is approval-gated, and inbound messages produce drafts, not sends. The app prepares; you decide what actually leaves your machine.

Tune it once

Turn the gate on for the tools that scare you, pre-approve the boring ones, and you can let workers run with confidence.

Setting the gate where it belongs

The gate is only useful if it fires on the right things — too tight and you rubber-stamp everything, too loose and you find out afterwards. Three settings that work in practice:

Gate everything that reaches a customer, forever. Sending email, posting publicly, replying in a channel. This is the one category never worth pre-approving, no matter how good the worker gets, because the cost of one bad send isn’t measured in tokens — it’s measured in a relationship. Reviewing a draft takes fifteen seconds; apologising takes a week.

Pre-approve the boring, reversible work. Reading files, searching the web, writing to your own notes or the Library. If you find yourself approving the same harmless action for the tenth time, you’ve turned the queue into noise — and a noisy queue is one you stop reading. Fast-path those so the queue only contains things that genuinely deserve a decision.

Chain sign-offs for the rare, expensive ones. For a Routine that touches money, contracts or anything regulated, require several approvals in order. It’s slower on purpose: the delay is the feature, because it forces a second pair of eyes on the small number of actions where being wrong is costly.

The failure mode is you, not the app

The realistic risk isn’t the gate failing — it’s approving without reading. If your queue has twenty identical items, the fix is pre-approving that action, not skimming faster. Keep the queue short enough that every item still gets a real decision.

Recap

The gate pauses flagged, irreversible actions and routes them to your queue, surfaced inline and in a banner — and you can fast-path the safe cases or chain multiple sign-offs for the sensitive ones. That completes the autonomy track: scheduled work, a proactive assistant, bounded autonomy, and a human at every risky step.

📖 Reference in the docs: Budgets & approvals · Cost & budgets

➡️ Next: Back to the curriculum →