Approval policies, limits, allowed hours, hand-offs and the emergency stop.
A policy is a condition on a tool call. When a call matches, the run pauses in waiting_approval, approvers are notified with the full context, and the run continues only after approval.
approvals:
- tool: netvisor.purchase_invoices
when: amount >= 5000 or supplier.new
approvers: ["finance-leads"]
timeout: 48h
on_timeout: handoff
- tool: email.send
when: recipient.domain != "example.com"
approvers: ["ops-leads"]
Conditions use the tool's parameters and the run's context (amount, supplier.new, recipient.domain, confidence, customer.tier…). Approvers are users or groups; any one member can decide. Decisions, identity and timestamp are recorded in the trace.
Approvals arrive in Slack, Teams, the web app and email, and via POST /runs/{id}/approvals/{approval_id}.
| Limit | Purpose |
|---|---|
max_runs_per_hour / per_day | Cap volume |
max_tool_calls_per_run | Stop loops |
max_spend_per_run / per_day | Cap model and tool cost |
allowed_hours | Only run during set hours in a time zone |
max_concurrency | Runs in parallel |
Exceeding a limit pauses new runs and notifies the escalation contact.
min_confidence on knowledge lookups: if a decision depends on a retrieved fact below the threshold, the agent requests approval or hands off instead of acting.
handoff_to names a person or queue. When the agent can't complete within its rules, it writes a case summary — what it read, what it tried, what's missing — and ends the run as handed_off. Hand-offs land in Slack/Teams, the web app inbox, or a ticket in your ticketing tool.
Agents → Stop all or POST /workspace/emergency-stop halts every running agent immediately and blocks new runs until an admin resumes. Per-agent stop is available on each agent page. Both are recorded in the audit log.
Test versions cannot use write tools for real; they are simulated. Only a promoted production version can write.