An agent may ask. Only a person may release.
The risk classes, the policies, the approval gate and the reversal — how a Knotbind workspace decides what an agent is allowed to change.
Classes of action
| Risk | Means | Goes unattended |
|---|---|---|
| read | Looks something up; changes nothing | Yes |
| quote | Prices or reserves nothing; asks the provider what it would cost | Yes |
| reserve | Holds capacity another call can confirm | No. Needs a person |
| create | Makes a record that did not exist | No. Needs a person |
| pay | Moves money or credit | No. Needs a person |
| cancel | Removes or releases something live | No. Needs a person |
How a request runs
-
An agent asks
POST /api/v1/actions/workflows/startor the MCP toolstart_action_workflow, with the workflow, provider and inputs. -
Policy decides first
A step whose tool is blocked, or whose risk the active policy does not cover, is refused before a run exists — there is nothing to approve later. A credential-shaped value in the inputs stops the call and is recorded so you can rotate it.
-
A person releases it
A run that includes a write waits as
pending_approval. The Owner — never the agent, not even the one that started it, and not a teammate — releases it from the dashboard. An alert named An agent action waits for approval is sent on every channel and cannot be switched off: a waiting run does not move by itself. The run page shows the exact resolved call before release. -
Steps keep their record
Each step is stored with its arguments and result before the next starts. A step that ends without a verifiable answer stops the run for a person: Knotbind never repeats a write it cannot prove did or did not happen.
Policy reference
A policy binds one agent to one capability, lists the risks it may request, caps amounts and expires. Three lists fine-tune it: allowed tools (empty means no list), blocked tools — which win over anything else — and irreversible tools, which wait for the Owner even under a generous policy.
Stop and reverse
An Owner can stop every agent action in the workspace with one switch; reads, Checks and your own API keep working, and resuming is a person's choice. A finished run can be reversed only if every write step recorded an undo: the reversal is a new run, undo calls in the opposite order, and it waits for approval like anything else. Half-undoable runs are refused, naming the steps that cannot be undone.
What this does not do
- Retry a write that ended unknown, ever.
- Let an agent approve, extend or widen its own request.
- Simulate a write in a sandbox before approval — the preview shows what would be sent, and sending is still gated by you.
- Delegate approvals to anyone but the Owner.