Control and auditability

Every run has boundaries

Your plan allowance, workspace policy, approved action set, and protected actions are checked before applicable work starts. Hard execution limits apply to the operations that have them enabled, and coverage is widening operation by operation.

One completed workflow uses one automated run. Retries and internal attempts do not silently multiply usage. Safety controls such as pause and stop remain available when plan limits are reached.

See what ran and why

Signed-in run details connect the trigger, approval and policy evidence, attempts, result, and any change made in an external account. Recent automated work is on your workspace observability page.

Retries do not mean duplicate actions

Idempotency keys and worker ownership checks reduce duplicate work, and allowance reservation does the same for the actions it is enabled on so far. When a provider outcome is unclear, the work stops for review instead of blindly repeating. We cannot control what a connected provider does on its side, so we do not offer a guarantee about provider-side behavior.

Useful progress, not just a green process

For safe analysis and draft workflows, a run that finished mechanically is still labeled completed, blocked, empty, or needing follow-up, so an empty result is not reported as success. Follow-up measurements say improved, worsened, unchanged, or unknown, without claiming a change caused the result.

People keep the consequential decisions

Sends, spend increases, payouts, publishing, and conversations keep their exact approval or human handoff. Automation prepares the work; you decide.

Sensitive internals stay private

Run records show bounded, customer-safe evidence. They leave out secrets, plaintext personal data, model reasoning, raw prompts, vendor contract rates, and unbounded provider payloads.