How ampm decides what an agent may do

Three kinds of agent can act for you in a workspace: the Assistant, Autopilot and any outside agent you connect. They all follow one set of permission rules, so what you learn about one applies to the others.

What a grant is

A grant lets an agent do one of two things:

Carry out an action tool, such as creating an idea or setting a task's priority. The tool catalog lists them.
Answer a category of approval, such as plans or follow-up filing. Approval categories lists them. Some categories are riders on another's decision. Move anyway, which lets a response or a task-moving tool go past a dependency-order warning, is one. It is off unless you select it, and Autopilot is always refused when it sends it.

A grant can carry two optional parts. A note records why you gave it. A bound narrows which decisions the category authorizes, for example approving but never sending back. Without a bound, the category allows every decision ampm's rules permit for the approvals it covers.

An outside agent's grant is fixed for its session. The Assistant and Autopilot each work from a saved permission profile, and a caller always uses one fixed version of it.

The case floor

Every kind of approval ampm can raise is classified once. Either some categories can answer it, with a stated list of decisions, or it is human-only and carries a reason.

That classification is the Agent Access case floor, and it sits below every grant:

A human-only approval is human-only for everyone. No grant can name it, and an agent cannot request or carry out a response to it. An agent can still read the card and recommend what you should do.
An approval that some category can answer is open to an agent only when every category the response needs is granted, and the one category that authorizes the decision includes it in its bound.
A new kind of approval starts human-only until it has been deliberately classified, so it cannot become agent-answerable by resembling an existing one.

Approval categories lists what stays with you.

Where agents differ

The rules are the same. Only the starting bound differs:

An outside agent and the Assistant start unbounded within what they were granted.
Autopilot starts from a shipped set: it may approve an exact proposal as written, and release a parked task with a typed recovery. It holds the rider categories only as riders on those. It also holds Base branch fix filing at Up to P1, which no agent can use yet. Your own grant is the only thing that widens that set.

Autopilot does not receive a credential or a session. It records each action before it acts, and a repeat of the same action is refused before anything is written. If the shared check refuses an answer Autopilot chose, the card shows the reason in the check's own words and Autopilot reads it the next time it looks at the card. A refusal that clears by itself, such as follow-up cleanup still running or an agent run still working on the task, leaves the card with Autopilot until it clears, and Autopilot hands the card to you with the reason if it has not cleared by the end of its hold. Any other refusal goes to you straight away. When Autopilot confirms a pull request was merged elsewhere, it first checks that the named pull request is recorded as merged. In Shadow mode it only records the advice it would have given.

Who checks what

For every call, the agent's own layer runs first and can only refuse or narrow. For Autopilot that layer confirms it still holds the card, the card and plan are current, no human question is open, and landing evidence supports a merge. After that, all three kinds of agent go through the same grant check, the same checks that the approval is still open and its fingerprint is current, the same audit record, and the same code that carries the decision out.

Who wrote the guidance

When a seat re-runs after someone answered an approval, it is told who wrote the answer: you, Autopilot, the Assistant, or a named outside agent.

Your own answers read exactly as they always did.
An answer from another author is labeled with its author. The label adds one line: the direction was written under your grant, and your own words win wherever they conflict.
Autopilot's direction is kept apart from yours, so text an agent produced is never read back as if you had written it. Standing guidance you wrote, which Autopilot only passes along, stays attributed to you.
An answer recorded before authors were tracked reads as yours.

The name shown is the one in force when the answer was given.

Checking your own requests

In Activity, choose Request history to inspect your recorded actions in the current workspace. A Check request status link on an action error opens that request directly. Checking status never submits the action again. A missing receipt means the outcome is still unconfirmed; it does not prove that the action failed. Completed requests stay visible even when a referenced resource has since been removed. History shows safe summaries and references, not submitted secrets. A pull-request check can stay accepted while a GitHub update is unconfirmed. Scheduled checks continue it; a status check does not resend the update. This page is private to your signed-in operator identity. Agents retain their separately scoped self-audit access and cannot read your history.

Discussing an approval

You can discuss an approval with the Assistant from its decision card. Open Add a consideration for this decision, explain what the Assistant should consider and why, then choose Reconsider with this context. The advice stays with that approval; it does not let an agent answer a human-only decision or gain a permission. You still review the live decision and submit your response. To keep useful context for future decisions of that kind, choose Use as standing guidance for this kind of decision beside the recorded consideration.