Approvals
Anything that sends, posts, publishes or changes something outside Pythe waits for you. You see the exact action, can edit it, and only then does it run.
Updated 2026-10-13
The promise is simple: nothing leaves Pythe without your OK. It is enforced by a table in code that says, for every tool, what kind of effect it has and what it needs. The model cannot talk its way around it.
What needs approval
| Tool | Action | Where it goes | Effect | Autopilot can skip the wait |
|---|---|---|---|---|
gmail_send | Send an email from your Gmail | Gmail (the founder's account) | Writes outside Pythe | Yes, on Premium |
slack_post | Post to Slack | Slack | Writes outside Pythe | Yes, on Premium |
notion_create_page | Create a Notion page | Notion | Writes outside Pythe | Yes, on Premium |
hubspot_upsert_contact | Add or update a HubSpot contact | HubSpot | Writes outside Pythe | Yes, on Premium |
hubspot_log_note | Log a HubSpot note | HubSpot | Writes outside Pythe | Yes, on Premium |
github_open_issue | Open a GitHub issue | GitHub | Writes outside Pythe | Yes, on Premium |
github_open_pr | Open a GitHub pull request | GitHub | Writes outside Pythe | Yes, on Premium |
deploy_website | Publish a website on Vercel | Vercel (a public website) | Publishes | Never |
custom_http_post | A custom tool that sends data to a web address | The web address the tool was built for | Writes outside Pythe | Never |
Everything else is local to Pythe or read-only: writing files on the agent’s computer, running code there, saving to your Library, reading pages, searching the web and reading your connected apps. Those need no approval.
The four kinds of effect
| Effect | Meaning | Approval |
|---|---|---|
| Local | Changes only the agent’s own computer, files or Pythe itself. | None |
| External read | Reads from outside, such as a web page or a public API. | None, but only to public destinations. |
| External write | Changes something outside Pythe: an email, a Slack post, a CRM record, a pull request. | Always. Autopilot may skip the wait only for the listed actions. |
| Publish | Puts something on the public internet under your name: a website. | Always, and never autopilot. |
What happens when an agent asks
- The tool writes an approval row. It does not act.
- A card appears in the chat, in Needs you, and on Home. It shows what will happen, where it goes, and the exact content.
- The run parks in “waiting for approval”.
- You choose Approve, Edit (change it, then approve) or Reject.
- On approval, the action runs on the server with your own token. The run resumes with the outcome.
- On rejection, the run is told not to retry that action, to adjust or move on.
Safety checks on an approval
- Tamper-proof. An approval is bound to a hash of the workspace, the action and the exact payload as you saw it. If the stored payload ever changes outside the edit flow, it never runs, and says so.
- Edits are re-validated. Your edit goes through the same checks as the original.
- Only one decision wins. Two taps cannot run it twice.
- Dead requests stay dead. If the run was cancelled, failed or completed, approving does nothing and tells you why. Approvals for a run that ends are closed automatically.
- A lost acknowledgement never repeats a send. If the outcome was lost, the approval is marked as unknown rather than run again.
- Deploys are pinned to files. A website approval records the path, size and content hash of every file. A different set of files is refused.
Email specifics
- Emails go from your own Gmail, through a Google connection that must have sending enabled. See Google.
- Outreach must carry a sign-off and an opt-out line. If the draft lacks them, “If you would rather not hear from me again, just reply and let me know.” and a sign-off are added.
- Daily send caps by plan: 0 on Free, 50 on Base, 200 on Premium. The cap resets at midnight UTC.
- An address is a single valid recipient. Employees mark any address that is a guess.
From outside Pythe
Your own AI tools can read what is waiting with list_approvals. There is deliberately no tool that approves. See MCP: safety.