Autonomy and Approvals

Autonomy and Approvals

Autonomy modes

Three rungs, stored per run in agent_runs.mode:

• supervised — gate tool actions behind user approval.
• semi_autonomous — default; routine actions proceed under permission rules, sensitive ones park for approval.
• full_autonomous — widest latitude, still bounded: iteration budget, spend limit, permission rules, and governance checkpoints still apply. It does not run unattended on a schedule.

The mode can be changed on a run via set-mode.

Approval gates and permission rules

• A three-tier approval gate evaluates each gated tool call against ordered, revocable permission_rules rows (preset + tool pattern + optional path pattern → allow / ask / deny, lower priority first). Seeded default: coding / execute_command / * → ask at priority 50.
• ask outcomes park: the approval waits for an explicit user decision (approve once, deny, or decide later). Parked approvals are never auto-resolved.
• Every gated step records provenance (rule_id, group_key for batched decisions, decided_by: user / rule / system). Deleting a rule clears the link but preserves step history.

Spend guards

• Optional per-run budget in micro-USD (limit_micro_usd; NULL means no limit). Actual spend (spent_micro_usd) is recorded at finalize using policy default pricing.
• Breaching the limit terminates the run as spend_limit_exceeded (exhausted iteration/step budgets surface separately). Spend dashboards and activity feeds expose usage; nothing on the usage path leaves the machine.

See also: Agent-Runs, Security-and-Credentials, Database.