Permissions and approvals

Control exactly what each agent may do. Set tool, email domain, Slack channel, run and spending limits, and approve every send before it happens.

An agent that can do everything is a disaster waiting to happen. AgentOS gives each agent narrow permissions and asks a person before anything important happens.

Three layers of control

1. The agent's own settings: the tools it was given and whether write access is on.
2. The workspace policy for that agent: limits set by an admin that apply however the agent is instructed.
3. Approvals: a person confirms every real action that sends or changes something.

Write access

Write access means the agent may send email, create calendar events or post to Slack. It is off by default. Even when it is on, the agent can only prepare these actions in a real run. The action waits for approval.

The permissions screen

Admins set limits for each agent on the agent's page under Permissions:

• Email only to these domains: emails and calendar invitations may go only to these domains. If it is empty any address is allowed, but the approval shows a warning for people the request did not mention.
• Never email these domains: addresses at these domains are always blocked.
• Slack channels it may post to: the agent may post only to the listed channels. If the list is empty it may post nowhere.
• Runs per day: the most runs this agent may start in one UTC day.
• Monthly AI budget for this agent: the most this agent may spend on AI in a month. Leave it empty to use only the workspace limit.

The policy is checked at the start of every run and again for every tool call. It is checked a final time when you approve an action, so tightening a policy also stops actions that are already waiting.

Practice runs and real runs

A practice run is the default. The agent reads real data but only previews what it would send. Untick Practice run for a real run. In a real run each send, calendar change or Slack post is stored as a pending approval with its exact contents.

Approving actions

Open the Approvals tab. Each waiting action shows what it will do, such as the recipient, subject and message. Choose Approve and do it to run exactly what you see, once. Choose Reject and nothing happens. Only admins and owners can approve or reject.

Things to know:

• A waiting action expires after 48 hours and can then no longer be approved.
• Approving twice is impossible: a second click is refused, so nothing is sent twice.
• Warnings appear in red when an agent is about to write to someone the request never mentioned and the agent did not see in the mail it read. Read them before approving.
• An agent can queue at most 3 actions in one run, and a workspace can hold at most 50 pending approvals.
• If the workspace is paused, nothing can be approved until you resume.

Why an action might be blocked

Blocked actions appear in the run's step list. Common reasons are that write access is off, the workspace policy does not allow the recipient or channel, the needed connection is not set up, or the run was stopped because suspicious instructions were found in content the agent read. See Safety and privacy.