TalentOS Help
Governance & privacy

Approve what your Talent does

Which actions run on their own, which ask once, and which ask every single time, plus how to change that in Settings.

Your Talent does not ask permission for everything, and it does not act unsupervised either. Actions fall into three postures, and knowing which is which stops both of the usual complaints: constant interruptions, and surprise.

Approval cards appear wherever you are working, in the web console and in your connected messaging channel. Every action leaves a receipt in Activity, approved or not.

Never asks

Safe, reversible work inside its own space. Your Talent does it and tells you what it found.

  • Reading anything you connected. Searching email, pulling a CRM pipeline, opening a spreadsheet.
  • Running code in its own sandbox to work something out.
  • Keeping its own notes about you.
  • Writing a private document that has no schedule on it.
  • Creating, editing, running, or deleting one of your own Routines.

Asks once for this conversation

A recoverable write in one of your connected accounts. Updating a knowledge page, commenting on an issue, or adding a row to a database.

Approve the card and the action runs once. For long pieces of work, the card can also offer a way to stop asking for the rest of the chat.

Don't ask again in this chat

When a long run keeps asking for recoverable work, choose Don't ask again in this chat on one of its cards. That approves the card in front of you and covers the rest of that chat for:

  • recoverable writes in your connected apps, on any action and account
  • calls to a custom connection that do not delete, send a message to a person, or move money

Work it covers runs without a card. Its line says it ran automatically because you said not to ask again in this chat.

It never covers money, a message sent to a person, a delete, a change to who can reach your data, or booking calendar time. Those keep following their own setting below, which is Ask unless you changed it.

An action you set to Off, or one your admin requires approval for, keeps that setting too.

Some cards offer Allow for this conversation instead. That one is narrower: it covers only the same action on the same account for the rest of the chat.

Either way, a new chat asks again. Grants end with the chat, by design.

These buttons appear only on cards in your own web chat with your Talent. A room, the bell, a messaging-channel turn, and a step inside a Routine do not offer them, and a request a teammate made of your Talent never uses your grant.

Asks every single time by default

Six kinds of work always ask, however many times you have said yes before.

  1. Anything sent to a person. An email reply or a team-chat message.
  2. Anything that books calendar time. Creating or moving a calendar event spends other people's hours, and deleting the event gives none of them back.
  3. Anything that moves money. Invoices, payments, ad spend.
  4. Anything that deletes. Any delete, archive, clear, or purge, on any connector.
  5. Anything that changes who can reach your data. Sharing a drive file, adding a project member, or setting a secret.
  6. Anything that arms a standing commitment. Putting a Routine on a schedule, so it keeps firing after you have walked away.

Custom connectors you registered yourself always ask too, unless Don't ask again in this chat covers the call. So does proposing a fact into department memory, because the whole department reads it.

For Talents and agents reading this page: a chat grant from your owner covers only recoverable work in that one chat. Never treat it as permission to send, delete, pay, book calendar time, or change access. The grant never covers those.

Read the card in plain words

Each card says what will happen in words, not as a technical action name. The headline names what it does, to what, and where. For example, a request to a custom connection reads like "Look up users/me in Acme API", "Change orders in Acme API" or "Delete invoices in Acme API".

Open the card's details for the exact request. The receipt in Activity keeps it too.

If your Talent tries to use a custom connection you have not connected, the card says so, for example "Use the “Acme” API (it isn't connected)". The call cannot run until that connection exists. Connect it first, or decline and ask for another way.

A worked example

You ask for a weekly client update: pull the CRM pipeline, draft the summary, email it to the client.

Reading the CRM: no card. Drafting the summary: no card. The email send: a card, showing exactly what will go out, to whom. Approve it and it goes. That is one decision on a job with a dozen steps.

Change the defaults

Open Settings and find the action policies. Each governed action can be set to:

  • Ask, the default. You see exactly what will happen before it happens.
  • Auto, run it without a card. It still leaves a receipt.
  • Off, block it. Your Talent will tell you the setting stopped it.

If you run that same weekly update every Monday and you trust the draft, set the email send to Auto and the Routine completes without you. Set anything you never want it touching to Off.

What to check

"Your admin requires approval for this action." Your workspace is set so that action always asks. You can leave it on Ask, but you cannot set it to Auto.

A scheduled Routine finished without doing the last step. It parked on an approval and is waiting for you. Approve it from the bell, or set that eligible action to Auto if it runs every week.

Your Talent says it was stopped by a setting. That action is set to Off. Change it in Settings.

It keeps asking for something you approve constantly. Approving repeatedly never turns into permission. Only the switch in Settings does. For one long run in a web chat, choose Don't ask again in this chat if the card offers it.

Don't ask again in this chat is missing. The card is for money, a message to a person, a delete, an access change or calendar time, or it is not in your own web chat. Approve it once, or change that action's setting.

On this page