Core conceptsAgents & workflows

Agents and workflows

An agent proposes an action; a policy decides whether it may run. The policy is a pure function of two things, the workspace autonomy level and the action's own risk metadata, so the same action at the same level always resolves the same way. Nothing about it is a model's judgement.

The decision, and what goes into it

Every agent action carries three pieces of metadata: a risk tier of low, medium, high or critical, whether the effect can be cleanly undone, and whether it touches the world outside SAGARIS. Drafting an email is low risk, reversible and internal. Placing a call is high risk, irreversible and external. Issuing a refund is critical, irreversible and external.

The decision that comes back is one of three: run it, hold it for a named human, or refuse it outright. When it is held, the policy also says whether a rep or a manager has to sign it off.

An action whose metadata the policy does not recognize, an unknown risk tier or a missing reversibility flag, is blocked before any level logic runs at all. A malformed action cannot fall through to a permission, and no autonomy level can bypass that check because it happens first.

The four levels

Manual
Nothing runs unattended. Every action waits for a human, whatever its risk.
Assisted
Auto-runs low-risk reversible actions only. Everything else waits, and high or critical actions escalate to a manager rather than a rep.
Supervised
Auto-runs low and medium risk actions that are reversible. High and critical need approval, a critical irreversible external action is refused outright rather than held, and a low or medium action that is irreversible is held rather than quietly run.
Autonomous
Auto-runs low and medium risk, and high risk where the action is either reversible or has no external side effect. An irreversible high-risk action with an external side effect still waits. Critical still escalates to a manager.

One floor sits under all four, and autonomous does not lift it: an action that is critical, irreversible and externally visible can never run unattended. It is refused at every level.

The tools that reach a person cannot send

This is the part worth reading twice. The agent's tool catalog includes tools that would email a contact, enroll them in a campaign, or book a meeting with them. In the executor, those three are proposal-only: there is no send path behind them.

They are still dispatchable, deliberately, so that a plan to launch a campaign surfaces as a visible proposal rather than as a confident false success. What comes back is a proposal a human confirms on the real send surface, and every payload carries an explicit not-sent flag so no caller can mistake one for the other.

  1. The global outbound gate is checked first, and it reads only the environment. If it is shut the tool fails there. No approval, autonomy level or parameter gets past it.
  2. Suppression is checked next. A suppressed contact is never even proposed for outreach, whether the gate is open or not.
  3. Only then is a proposal produced, awaiting a human. It sends nothing, enrolls nobody and writes no record.

The tools that do write, advancing a deal stage, creating a task, suppressing a contact and pausing a sequence, each own a dedicated handler. That is a fix rather than a flourish: advancing a deal stage once routed into the contact-update handler, so it reported success while writing the wrong table. A canonical tool name can no longer be dispatched into another tool's handler.

Earned autonomy, which is not switched on

The autonomy level is an operator's static choice today. There is a built ladder that would make it earned instead, per workspace and per action type, and it is off. Two separate switches govern it and both default off, in a deliberate order: one starts accumulating a track record, and the other lets the ladder read it. Turning the reader on against an empty table would pin every workspace to manual, so the record has to build first.

When it is on, the shape is worth knowing because it is stricter than a static setting rather than looser. Everyone starts at manual. A rung needs two independent things: humans accepting what the agent proposed, and the actions that ran actually landing well. A high acceptance rate on an action type that was almost never executed does not climb, because autonomy is earned on results and not on rubber stamps. A bad window demotes straight back to manual regardless of history.

The ladder cannot weaken anything. It only computes a level, and that level is fed to the same policy, which enforces the same floor. A perfect track record that earns autonomous still cannot auto-run a critical irreversible external action.

Multi-step work

Automation that runs over days is the sequence: an ordered set of steps, each with a channel, dispatched by the scheduler. The Channels page covers which step channels dispatch on their own and which park until a person acts, which is the thing most worth knowing before you build one.

Behaviour on this page is read from

  • src/lib/auto-execution-policy.ts
  • src/lib/agent/a4-tool-catalog.ts
  • src/lib/agent/execution.ts
  • src/lib/agent/autonomy-ladder.ts
  • src/lib/agent/autonomy-track-record-provider.ts
  • src/lib/outbound-gate.ts
  • src/lib/suppression-store.ts
  • src/lib/sequence-step-dispatch.ts

Was this page helpful?

Book a demo