Autonomy and approvals
Control when the agent can use tools automatically and when it must ask for your approval.
Autonomy settings determine how much the agent can do before asking you to approve a tool call. You can set separate policies for channel runs, DM runs, and delegated subagents that operate on your desktop.
DM and delegated approval settings are stored on your personal desktop. Channel agent run autonomy is a workspace-wide setting stored on the Team Desktop, so every member shares the same policy.
Where to find it
Open Settings → Agent.
When a tool requires confirmation during a run, an approval card appears in the channel with Approve and Deny actions.
Resource boundary
Every agent run is tied to a trigger user. The agent can use only resources that user can access, including:
- The selected runtime's desktop filesystem (Team Desktop for many channel runs, or a personal desktop).
- Files shared with the user through Team Drive, Shared with me, or channel shares.
- Integrations, MCP servers, and skills that the user owns or that have been shared with them.
- Channels and other workspace objects the user is allowed to see.
The agent does not silently access another member's private home directory or private credentials. Work that requires another person's private resources must run as that member. From a personal desktop, the agent can also switch into the Team Desktop via a subagent with run_as_user_id="endstack"; that path uses the workspace Channel agent runs autonomy setting, and approval cards stay in the parent channel (task, public/private, or DM).
Channel agent runs
The Channel agent runs setting is workspace-wide. It applies to non-DM channel runs, including public or private channels and remote triggers that use the channel agent runtime, regardless of which member starts the run.
| Option | Behavior |
|---|---|
| Ask for everything | The agent asks permission before executing every tool. |
| Auto (AI tool review) | Read tools run freely; an AI reviewer evaluates write/side-effect tools against your Auto tool review policy. |
| Run everything | The agent runs tools without asking for permission. |
DM agent runs
The DM agent runs setting provides the same three options for runs in your Endstack DM (personal desktop runtime).
Subagents on your desktop
The Subagents on your desktop setting provides the same three options for delegated runs. It most commonly applies when a subagent runs as you even though another member started the parent conversation.
For example, suppose Alex asks the agent for a file that exists only on Blake's private desktop:
- Alex's agent cannot read Blake's private file directly.
- The agent can dispatch a subagent that runs as Blake.
- That subagent uses Blake's resource boundary, including Blake's files and private integrations.
- Tool calls follow Blake's Subagents on your desktop policy.
This setting does not let teammates casually take over your desktop. It controls approval behavior when another member's workflow needs a step to execute as you, such as:
- Reading or editing one of your unshared files.
- Using a private integration that you have not shared with the workspace.
- Completing a step that must run in your user container.
Choose Ask for everything or Auto (AI tool review) here if you want additional review whenever a delegated workflow uses your access.
Auto tool review policy
The policy editor appears when any permission level is set to Auto (AI tool review).
- Enter up to 10,000 characters of Markdown instructions.
- Describe which tool calls should require your explicit approval.
- The reviewer uses the policy across channel, DM, and delegated runs.
- Select Save to persist your changes.
How the settings affect a run
- Ask for everything pauses every tool call until you select Approve or Deny on its in-channel card.
- Auto (AI tool review) lets read tools run without review; the reviewer decides write/side-effect calls from your policy. Unmatched external side effects can still require manual approval.
- Run everything removes the approval gate, but product safety limits and channel or task constraints still apply.
Task channels can additionally skip approvals for scheduled work through Whitelist task tools. See Tasks.