The review queue
When an agent produces work — a drafted reply, a social post, a captured lead, a weekly digest — it lands in your review queue rather than going out. You approve it, edit it, or dismiss it. Until you do, it has had no effect on anyone outside your workspace.
The one real-time exception is live chat: an agent answering a visitor on your site replies in the moment, because a support conversation with a queue in the middle of it is not a support conversation. Those agents are constrained differently instead — they answer only from the material you gave them, and escalate to a person rather than guessing.
What happens before you ever see a draft
A draft passes two code gates before it reaches your queue, and neither involves a model deciding whether a model was right:
- Figures are traced.Every price, percentage, date and count in a draft must appear in the material it was written from. One that doesn’t is withheld — the run records that it withheld something and why, so a quiet run is never mistaken for a clean one.
- Quotes are located.Where an agent claims a page or a document says something, the quoted text has to be found in that page or document. A quote that can’t be located downgrades the finding to unverified, and unverified findings never raise an alert.
Customer-facing drafts then get a second pass from a reviewer model that checks them against the same evidence — and any edit it proposes is re-checked by the same code gates, so a revision can never reintroduce something the gate just removed.
Autopilot
Some work is genuinely internal: a weekly digest, a site health report, an audit of your own knowledge. Autopilot lets an agent complete that kind of work without waiting for you. It cannot be turned on for anything customer-facing — that restriction is enforced in code, not by configuration you could get wrong.
Governance controls
- Second approver. Require two people to sign off before an item finalizes, optionally only above a value threshold.
- Approval before anything external. Force an explicit approval on every output type that leaves the building.
- Pause. Stop one agent, or the whole fleet, immediately.
- Budgets. Cap monthly spend per workspace; runs stop at the cap rather than billing through it.
Every approval, edit, dismissal and settings change is written to an audit log you can export. See Security for how that log and your data are isolated.