Autonomy & the kill-switch

Letting workers run unattended only feels safe because of two controls: a per-worker allowlist that bounds what each one may do, and a single switch that halts everything.

What you’ll learn

• How a worker’s tool allowlist sets its autonomy.
• How per-tool and per-run limits stop runaway loops.
• Where the global kill-switch lives and what it stops.

Autonomy is the allowlist

A worker can only ever use the tools on its allowlist (its Skills tab) — least-privilege by default, so a writer never holds the shell. That allowlist is its autonomy: the broader it is, the more a worker can do on its own during an unattended Routine or Plan.

1. Open a worker’s Skills tab.
2. Add only the tools that job genuinely needs.
3. Leave irreversible tools off, or gate them (next lesson).

Bound each run

In Settings → Providers you can cap how many times a single tool runs in one run and how many back-and-forth iterations a run may take. Refused calls hand the model an error instead of executing — so nothing spins in circles.

The kill-switch

Above everything sits one Autonomy switch. Flip it off and all unattended activity pauses at once — Plans, Routines, channel replies, heartbeats.

The big red button

The kill-switch is for “stop the workforce now,” whatever is running. One click, everything stops — no per-worker hunting.

Set a global budget too

Before letting workers run alone, add a global budget with hard-stop on. The allowlist bounds what they do; the budget bounds how much they spend.

A sensible first month

Don’t start at full autonomy, and don’t stay at zero either. A progression that works:

Week one — nothing runs unattended. Every task is one you started, in a chat you’re watching. You’re learning what your workers are actually good at, and that judgement is what every later decision depends on. Set a global budget with hard-stop on before you do anything else.

Weeks two and three — one Routine, tightly bounded. Pick something low-stakes and repetitive: a morning digest, a weekly summary of what changed. Give that worker a narrow allowlist — read and write to your own notes, nothing that sends. Then read its output every day for a fortnight. You’re checking one thing: does it stay useful when you’re not watching?

Week four onward — widen where it earned it. Add tools to the workers whose unattended output you’ve actually been reading and approving. Leave the rest narrow. Autonomy is something a worker earns from evidence, not something you grant because the feature exists.

The one setting to change before you sleep on it

Before the first Routine runs overnight, set the global budget with hard-stop enabled. The allowlist bounds what a runaway loop can do; only the budget bounds what it can cost. A capped mistake is an annoyance — an uncapped one is a bill.

Recap

Each worker’s allowlist sets its autonomy; per-tool and per-run limits keep a run from running away; and the global kill-switch stops everything instantly. Next: the gate that lets agents prepare risky actions but keeps the final yes with you.

📖 Reference in the docs: Dashboard · Budgets & approvals

➡️ Next: Approvals: humans approve, agents prepare