Autonomy and approvals
Control when the agent can use tools automatically and when it must ask for your approval.
Autonomy settings determine how much the agent can do before asking you to approve a tool call. You can set separate policies for channel runs, DM runs, and runs where the team's agent reaches into your desktop.
Your DM and team-access approval settings are stored on your personal desktop. Channel agent run autonomy is a workspace-wide setting, so every member shares the same policy and only workspace admins can change it.
Where to find it
Open Settings → Agent.
When a tool requires confirmation during a run, an approval card appears in the channel with Approve and Deny actions.
Resource boundary
Every agent run is tied to a trigger user. The agent can use only resources that user can access, including:
- The selected runtime's desktop filesystem (Team Desktop for many channel runs, or a personal desktop).
- Files shared with the user through Team Desktop, Shared with me, or channel shares.
- Integrations, MCP servers, and skills that the user owns or that have been shared with them.
- Channels and other workspace objects the user is allowed to see.
The agent does not silently access another member's private home directory or private credentials. Work that needs a different desktop has to move there explicitly. Every such switch is governed by the workspace Channel agent runs setting, whichever desktop it lands on. Where the approval card appears still depends on the target: switching into the Team Desktop keeps cards in the channel where the run started, while switching into another member's personal desktop delivers their approval requests to their own Endstack DM.
Channel agent runs
The Channel agent runs setting is workspace-wide. It applies to non-DM channel runs, including public or private channels and remote triggers that use the channel agent runtime, regardless of which member starts the run. It also governs every desktop switch a run makes, including a switch into a member's personal desktop.
| Option | Behavior |
|---|---|
| Ask for everything | The agent asks permission before executing every tool. |
| Auto (AI tool review) | Read tools run freely; an AI reviewer evaluates write/side-effect tools against your Auto tool review policy. |
| Run everything | The agent runs tools without asking for permission. |
DM agent runs
The DM agent runs setting provides the same three options for runs in your Endstack DM (personal desktop runtime).
Auto tool review policy
The policy editor appears when any permission level is set to Auto (AI tool review).
- Enter up to 10,000 characters of Markdown instructions.
- Describe which tool calls should require your explicit approval.
- The reviewer uses the policy across channel and DM runs.
- Select Save to persist your changes.
How the settings affect a run
- Ask for everything pauses every tool call until you select Approve or Deny on its in-channel card.
- Auto (AI tool review) lets read tools run without review; the reviewer decides write/side-effect calls from your policy. Unmatched external side effects can still require manual approval.
- Run everything removes the approval gate, but product safety limits and channel or task constraints still apply.
Task channels can additionally skip approvals for scheduled work through Whitelist task tools. See Tasks.