Nothing goes out without your yes.
Today an agent can read, research and draft, but it cannot send email. For WhatsApp and LinkedIn, coming next, every send an agent asks for meets a server-side gate: it runs, waits for a person or is refused, by rules only a member can change.
Autonomy levels. One level per action, set by a person.
A workspace sets a level for each kind of action, and can narrow it by channel and sender. A send with no policy gets the default: approve each.
Blocked
The agent cannot ask for this action at all. The request is refused and nothing is recorded to approve.
Draft only
The agent may prepare the work. A person sends it, or nothing goes.
Approve each
Every send waits for its own yes. This is the default for a message.
Approve batch
A reviewed list is approved in one decision, and anything left out stays pending.
Auto within budget
The action runs on its own, only where a member set this level and the credential was granted it.
The undo window. Approved is not sent yet.
An approved request waits two minutes before it is released. Cancel it in that window and it never leaves. A request nobody decides expires instead of going out late.
What an agent can never do. Some doors stay with a person.
These hold today for Claude over MCP, for an API key and for an OAuth app.
Send email
Tools that send a message are never exposed over MCP, whatever the scope. Starting a campaign needs a permission a self-registered client is never granted.
Decide a request
Approve, reject and batch approve are routes for a signed-in member. An API key, an OAuth token or an MCP tool gets a refusal.
Change its own rules
Autonomy policies are set and removed by a member in a session. No tool, key or token can change them.
On the chat channels. Built into the gate, released with WhatsApp and LinkedIn.
These are merged on the branch and apply to the channel tools, which are not released yet.
Frozen recipients
The recipient is fixed when the request is recorded. If the contact no longer holds that address at release, the request fails and nothing is sent.
Prospect text, wrapped
On the WhatsApp and LinkedIn tools, prospect text arrives wrapped as untrusted content with links neutralised, and a send in that conversation always waits for a person.
Blocks a member lifts
An agent can block an address on every channel. Only a signed-in member can lift that block, and the contact stays unsubscribed.
Coming next. More places to say yes, and a ceiling on every launch.
An approvals screen in the dashboard, Slack approval cards, signed links, send ceilings on campaign launches and approvals that go stale when a campaign is edited are planned. See the roadmap
Questions. Approvals, answered.
Does every message need a person to click approve?
For the WhatsApp and LinkedIn sends the gate covers, by default yes: a send an agent asks for is approve each. A member can choose a different level per action, channel and sender, including auto within budget for actions they are comfortable with. A send in a conversation that holds a prospect’s own words always waits for a person, whatever the level.
Can Claude approve its own request?
No. Approving is a session-only route. Claude, any MCP client, an API key or an OAuth token gets approval_needs_session when it tries, so the request stays pending until a member decides it.
What is the undo window?
An approved request is released two minutes after the approval. Until then a member or the requesting agent can cancel it, and cancelling only ever stops a send.
Where do I approve today?
Through the approvals API in a signed-in session. A dedicated approvals screen in the dashboard, a Slack card and a signed link are on the roadmap.
What does the gate cover today?
Requests to send on WhatsApp and LinkedIn, which are merged but not released yet. Email cannot be requested over MCP at all: an agent drafts, and people send from the inbox or launch campaigns themselves.
SalesOS is not an AI that sends for you. It never lets an agent approve its own request, and it is not a promise that every message is approved by hand: a workspace can choose to let some actions run within a budget.
Put a person on every send.
Install SalesOS, connect your Claude, and keep the decisions with your team.