Approving what an agent wants to do
An agent writes the draft. A person reads it. The action happens or it does not, and either way there is a record with a name on it.
- Every agent ships in review
- External sends need approval
- Every tool call is logged
The short answer
- The agent drafts: it writes the reply, the proposal or the message, attaches the evidence it used, and stops there without sending anything.
- A person decides: the draft waits in one approval queue showing the artefact, the evidence, a confidence value and the cost, with three actions available, which are approve, edit then approve, and reject with a reason.
- The system logs: the action executes only after approval, and every tool call is written to the audit log naming whether a person, a token or an agent made it.
Trigger to logged
The same four beats every time, whatever the agent is doing.
- 1
Trigger: something arrives or comes due
A reply lands in the inbox, a cadence step comes due, a marketplace job matches a search, or a scheduled run starts. The agent wakes up with a specific job rather than a general instruction.
- 2
SalesCrew drafts and checks the guardrails
The agent writes the artefact and the guardrails are applied before anything queues: at least three days between touches per contact, per-cadence caps, per-mailbox and per-domain daily caps, a business-hours send window, and suppression re-checked at send time. Below its confidence threshold, an agent in auto falls back to review instead of acting.
- 3
The human sees one queue
Items are grouped by agent. Each shows the draft itself, the evidence behind it such as the thread, the score or the knowledge-base sources it used, its confidence and its cost. The three actions are approve, edit then approve, and reject with a reason.
- 4
The action runs, or it does not
Approve and it executes. Edit and your version is what goes out. Reject and nothing happens, with the reason feeding the agent's next run. An item nobody touches stays in the queue; there is no timer that sends it for you.
- 5
Everything lands in the audit log
Every tool call is written with who or what made it, a person, a token or an agent, and when. When a client asks what the AI did on their account last Tuesday, the answer is a record rather than a reconstruction.
- 6
The kill switch stays available
One control on the Agents page stops every agent at once, and it has an MCP twin. The manual path is unaffected: turning the agents off never stops a person from working.
What gets configured
The default policy is seeded on every instance and edited under Agents, then Guardrails.
| Setting | What it controls | Default |
|---|---|---|
| Agent mode | Per agent: off, draft (writes the artefact and does nothing), review (queues it for a human), or auto (executes and logs) | Every agent ships in review |
| Policy: low-risk work | Research, enrichment, tagging, logging, scoring, summaries, internal tasks and suggested contacts | Auto |
| Policy: reply handling | Classifying a reply, pausing a cadence on reply, suppressing on unsubscribe or bounce | Auto |
| Policy: external sends | Any email, LinkedIn message, SMS or marketplace proposal leaving the building | Review |
| Policy: record changes | Stage changes, contact merges and deletes; creating a deal from a positive reply and booking a meeting | Review, with the last two moving to auto after a clean week if you choose |
| Policy: spend | Credits, connects, ad budget, and anything outside the CRM | Human only, in every mode |
| Guardrails | Minimum days between touches per contact, per-cadence cap, per-mailbox and per-domain daily caps, business-hours window, suppression re-check at send, confidence threshold | At least three days between touches; the rest set per instance |
Where it stops and a human starts
The line is drawn at anything that leaves the building or costs money. An agent can read, research, score, tag, summarise and classify without asking. It cannot send an email, a LinkedIn message or a proposal to a real person without someone reading it first, unless you deliberately change that policy.
Spend never crosses the line at all. Credits, connects and ad budget are human-only in every mode, including auto. That is not a default to be relaxed; it is where the design stops.
The queue is a real workload, and that is worth saying plainly rather than selling review mode as free. Somebody reads those drafts. The way this stays manageable is to move the safe classes to auto once you have watched them for a week, and keep the external sends in review. An agency that leaves everything in review will build a backlog; one that moves everything to auto has bought a bot and not a control plane.
There is also a quieter benefit for an agency specifically. Because every tool call is logged with the actor named, the question a client eventually asks, which is what the AI did on their account and whether anyone checked it, has an answer you can show them.
Questions
- What happens if nobody approves a queued item?
- Nothing goes out. That is the point of the design: an unattended queue is a stalled queue, not a queue that sends by itself after a timer. If a client's replies are piling up unapproved, the fix is a person reviewing them or a deliberate decision to move that action class to auto, not a fallback that sends the drafts anyway.
- Can I run an agent in auto for some actions and review for others?
- Yes, and that is the normal setup. Modes are per agent, and the policy table sets a default per action class underneath them. Research, enrichment, tagging, scoring, summaries, reply classification and pausing a cadence on reply default to auto. Every external send defaults to review. Anything involving spend, meaning credits, connects or ad budget, stays human-only whatever the mode says.
- What does a rejection actually do?
- The action does not happen, and the reason you give is fed back into the next run for that agent. A rejection is the correction signal, so a one-word reason teaches nothing and a specific one changes what the next draft looks like. Editing before approving works the same way: the version that goes out is yours, and the difference is information.