DocsAccess and roles
Approvals and dry runs
Nothing changes without a yes. Every write is a dry run first, and agents wait for a person before they act.
Dry runs for every write#
Every action that creates, sends or changes something runs as a dry run first. It reports what it would do, and nothing is sent. Your AI then asks you, and repeats the action with a confirm flag.
In the CLI, add --confirm to do it for real. Recipes refuse --confirm entirely.
Actions that only read can never write. Homla blocks it, even if the tool would allow it.
Approvals for agents#
When you give an agent a tool, each write action is set to:
- Ask first
- The default. Waits for a person in Homla or Slack.
- Auto
- Runs without asking.
Read actions always run.
Approve, edit or reject#
Open Agents, then the Approvals tab. Each card reads <agent> wants to <what>.
- Approve: runs now, as the agent.
- Edit, then Approve with changes: fix the details first.
- Reject: nothing happens.
If the agent has its own Slack app, the same buttons appear in Slack. Approvals are not sent by email.
Who can approve#
- Admins can approve anything.
- A member can approve an action if their own role allows that action.
An action runs once, even if two people click. A request left alone expires after 7 days.
Other things that wait for an admin#
- A new app, or a new app version that asks for more access.
- Rules and insights an AI saved to memory on its own.