Approvals
Which `live` actions need an approval before they spend credits or write externally.
An approval is explicit human confirmation before live work spends credits or writes to an external system. Not every paid action asks for one: the table lists the main cases, among them paid actions that authorize spend another way, such as one-off finds, single-cell reruns and table auto-runs.
What requires approval
| Action | Approval required |
|---|---|
Live tool run that is paid or writes outside OXYGEN (oxygen tools run --mode live, MCP oxygen_tools_run_live) | Yes. A paid run also needs --max-credits |
One-off find or email verification (oxygen find …, oxygen verify email, MCP oxygen_find_* and oxygen_verify_email) | No approval flag. A free dry_run by default; --mode live with --max-credits spends (MCP: mode: live with max_credits). On verify email, --approved is an alias for --mode live |
Search or scrape job (oxygen search run, MCP oxygen_search_run) | No approval flag. A free dry_run by default; --mode live runs it. A paid route also needs --max-credits, and a quote above it is refused |
| Column or table run on an AI, research, tool, or enrichment column | Yes — --approved with --max-credits |
Re-running one AI cell (oxygen columns rerun, MCP oxygen_columns_rerun_cell) | No approval flag. --dry-run quotes it for free; a live rerun needs --max-credits at or above that quote. Of the paid kinds, only AI cells rerun live; research, tool and enrichment cells rerun through a column run instead |
Rejecting a message review with --auto-rerun (oxygen reviews reject, MCP oxygen_reviews_decide with auto_rerun) | No approval flag and no --max-credits: the review's AI cell re-runs at once, capped at its current one-row quote |
Enrichment run (oxygen enrich-column run) | Yes — every run; preview first (free) |
Table auto-run (oxygen tables auto-run set, MCP oxygen_tables_auto_run) | No approval flag. Setting it arms a standing permission (see below): rows written to the table queue the columns you picked, and each batch stops at --max-credits or, if you leave it out, at your plan's default ceiling |
Knowledge synthesis (oxygen knowledge synthesize, MCP oxygen_context_synthesize) | No approval flag before it spends: the preview is already one paid AI call, and --max-credits caps it only when you set one. To keep what the preview showed, pass its text back with --approved --body: no new call, 0 credits. --approved alone synthesizes and charges again |
Live workflow call or event emit (--mode live) | Yes — --approved and --max-credits, even when the graph only reads |
Sequence launch (oxygen sequences start) | Yes — --approved, plus --max-live-sends when the sequence has email, WhatsApp, or CRM-task steps |
Sequence enrollment (oxygen sequences enroll) | No — free; an active sequence contacts new leads on its next tick, under its launch approval |
Newsletter test send (oxygen sequences test-send, MCP oxygen_newsletters with action: test_send) | No approval flag and no ceiling: it emails one newsletter step to up to 5 verified addresses of your workspace's members, at 0.05 credits per email and at most 20 test sends a day |
| Publishing a post | Yes — approval binds the exact copy; any content edit needs a new one (Publishing) |
| LinkedIn engagement, CRM sync, or pushing leads into an external campaign | Yes |
Harvesting a post's engagers through the managed scraper instead of your LinkedIn account's reads (oxygen engagement harvest --source cookieless, MCP oxygen_engagement_harvest with source: cookieless) | No approval flag or preview: the harvest starts at once, needs --max-credits, and pauses before a scraper page that would pass it. It still needs one connected LinkedIn sender, whose read allowance it leaves untouched. Harvesting through that account (--source unipile) is free |
Immediate permanent purge (tables delete --now, columns delete --now) | Yes — free but irreversible: refuses with a preview until re-run with --yes |
| A live tool call that is free and only reads | No |
dry_run / smoke_test anything | No |
Read-only commands (tables query, cells inspect, etc.) | No |
Approval gates are not only about money: a free action that irreversibly destroys workspace data (like an immediate purge) sits behind the same preview-then-approve pattern as paid spend. The default tables delete path needs no approval because it is reversible — the table stays restorable until its scheduled purge.
What to review
Before approving live work, check:
| Field | What to confirm |
|---|---|
| Scope | Table, column, workflow, filters, row ids, and row count |
| Provider or integration | Which tool, CRM, outbound system, or social action will run |
| Mode | live, not dry_run or smoke_test |
| Credit ceiling | The --max-credits value you are about to authorize |
| Preview | Sample inputs/outputs or a preflight result |
| Destination | External account, campaign, list, CRM object, or table column |
CLI and MCP responses include structured JSON and often a web_url; use the web view or widget to inspect the same run before continuing.
CLI patterns
oxygen tools run <tool-id> --input-json '{...}' --mode dry-run --json
oxygen tools run <tool-id> --input-json '{...}' --mode live --approved --max-credits 5 --json
oxygen table-runs create <table-id> --column <column-key> --limit 100 --approved --max-credits 100 --json
oxygen enrich-column preview <table-id> --capability work_email --limit 100 --json
oxygen enrich-column run <table-id> --capability work_email --limit 100 --approved --max-credits 100 --json
oxygen workflows call <workflow> --input-json '{...}' --mode dry_run --json
oxygen workflows call <workflow> --input-json '{...}' --mode live --approved --max-credits 100 --json--mode is required on every workflows call except a --preview, which runs nothing; a live call also requires both --approved and --max-credits.
Without --approved, oxygen enrich-column run fails with approval_required (exit 7) and spends nothing.
For generated-message review queues, use:
oxygen reviews next --json
oxygen reviews accept <review-id> --json
oxygen reviews reject <review-id> --auto-rerun --jsonReview queues are for human-in-the-loop content such as AI-generated outreach, not a replacement for preflighting paid provider runs.
Where pending items are decided
| Waiting on a decision | Decide it |
|---|---|
| A Workspace Copilot approval card | Approve or Reject on the card, or oxygen copilot approve <session-id> <approval-id> (add --reject to refuse). A chat set to Auto-approve raises no cards — see Copilot approvals. |
An Agent tool call paused by an ask rule | Approve and resume or Reject in the run transcript, or oxygen agent approval-decide — see Agents. |
A workflow run at an approval step, including a recipe's ctx.approvals.require | oxygen workflows approvals lists them; oxygen workflows resume <run-id> --decision approve (or reject) decides one and resumes the run. |
| A post waiting on approval | Approve… in the /posts queue, or oxygen publishing posts approve <post-id> — see Publishing. |
| An AI reply draft | Approve & send, Edit, or Reject in the AI Sales Agent's review queue — see Handle replies. |
| A request for a named person's go/no-go | oxygen approvals inbox, then oxygen approvals decide <request-id> --approve — see Collaboration. |
oxygen observability approvals --json lists the waiting workflow approvals, posts, message reviews, reply drafts, and second-party requests in one place, each with the exact command that decides it — see Observability. Agent pauses and Copilot cards are decided in their own run or chat.
Copilot approvals
In a Workspace Copilot or Oxygent chat, a paid step whose maximum quote (its max_credits ceiling) is under 100 credits runs without asking on every plan, and so do paid steps within your plan's approval-free allowance (Spend caps); the chat still tells you what each one cost. A larger paid step, a paid step with no quote, or anything that reaches outside the workspace — a send, a sequence start, publishing, a purchase, a sync — stops at an approval card: Approve runs it, Reject refuses it.
The approval menu in the composer, beside the model picker, sets how each chat asks:
| Mode | What happens |
|---|---|
| Ask for approval | The default. Paid steps above the allowance, and every action outside the workspace, wait for a card. |
| Auto-approve | Never asks, even for paid actions or sends: every action that would raise a card runs without one, each still within its own credit cap and your balance. Turning it on also approves the cards already waiting in that chat. Restricted actions, such as credentials and billing, stay refused. |
The mode belongs to one chat; a new Copilot chat starts with the mode you picked last in this browser. In an Oxygent chat your whole workspace shares, the mode is yours alone and starts on Auto-approve: it covers what you send there, never anyone else's messages, and their cards still ask them. A group chat with other people always asks each message's sender. Every auto-approved action is still recorded as an approval in the chat's event log (oxygen copilot get). From the CLI, oxygen copilot policy set --session-id <id> --auto-approve-policy paid (or off) changes a chat's mode, and oxygen copilot approve <session-id> <approval-id> decides a waiting card (--reject refuses it). MCP clients use oxygen_copilot_session_update with auto_approve_policy, and oxygen_copilot_approve.
Standing permissions
These grants let work run later without a per-delivery approval. Each is armed explicitly and stays bounded by a credit ceiling.
| Standing grant | How it is armed | Bound to |
|---|---|---|
| Autonomous workflow trigger (cron, webhook, event) on a tool-calling workflow | oxygen workflows enable <workflow> --approved --max-credits <n> | That workflow revision — publishing a new revision needs --approved again |
| Agent trigger (cron, event, webhook) | oxygen agent trigger-create with --max-credits and --approved, both required | That trigger; each delivery spends at most its --max-credits |
| Table auto-run | oxygen tables auto-run set <table> --columns <csv> --max-credits <n> | The saved column set; rows written by import, insert, upsert, or webhook queue those columns |
| CRM record enrichment | oxygen crm enrichment list, then oxygen crm enrichment enable <preset> --object <object> | The saved enrichment set on that CRM object; every record written to it enriches, bounded per batch (oxygen crm enrichment set --max-credits changes the batch ceiling) |
| CRM sync | oxygen crm sync enable with --approved, --max-credits, and --max-rows | That object pair's scheduled sync, until oxygen crm sync disable |
| Publishing amplification | oxygen publishing amplification enable <policy-id> --approved --acknowledge-risk | That policy and its --max-credits — see Publishing |
| Copilot Auto-approve | The composer's approval menu, or oxygen copilot policy set --session-id <id> --auto-approve-policy paid | That chat; every action runs without a card, each within its own credit cap — see Copilot approvals |
Where --max-credits is optional — a workflow trigger, a table auto-run, a CRM enrichment batch — leaving it out binds your plan's default per-delivery ceiling: a delivery or batch stops there. On a plan with no default, set an explicit ceiling. See Spend caps.
Related
- Modes — which modes require approval.
- Spend caps — the credit limit attached to every approved run.
- Runs — inspecting what an approved run actually did.
- Collaboration — asking a second person to decide, and the gate that holds a launch until they do.