Agent Autonomy & Governance

An agent that can send email and move money needs rails. Kavanah's answer is layered: what the agent is allowed to do (action policies), what it must never do (guardrails), when it interrupts a human (escalation), and an honest record of everything it actually did (the activity report).

Action policies

Risky actions are sorted into seven categories — Send messages & email, Move money & change the books, Delete & disconnect, Membership & access, Deploy & run external workflows, Write to connected tools, and Spend AI usage. Admins set a policy for each under Settings → AI Agent → Autonomous action policies:

Auto — the agent just does it.
Auto up to a daily limit — up to N times per day, then it starts asking.
Ask each time — the action is parked and waits for a human in Waiting for your approval on the same page.
Never — blocked outright.

A category with no policy setparks for approval. The default is fail-closed: silence means "ask me", never "go ahead". Widening a policy is a security decision — read the activity report first.

Guardrails

Guardrails are pattern rules that sit in front of everything else: block (or force approval on) any action matching a recipient, a keyword, or a specific tool (one AI employee may never move a deal's stage). The common case is a domain — never email a competitor, never message the board list — expressed once and enforced everywhere, including inside scheduled autonomous runs.

Escalation

When the agent hits something it can't resolve, it escalates to a human. In Escalation policy (Settings → AI Agent) you choose the severity that warrants an immediate interruption, who gets told (admins by default), and quiet hours — with the option to let genuinely critical issues punch through them anyway.

The activity report

Every write the agent makes is logged: executed, parked, blocked, failed, or undone. The report rolls this up by category and tool, alongside how its parked approvals were decided — ask the agent for it, or have an admin turn on Activity ledger under Settings → AI Agent → Agent Oversight to read it as a timeline (What the agent has been doing) on the same page. The undone count is the one to watch — it is the clearest signal that the agent is doing things you didn't actually want, and the cue to tighten a policy or write a Negation line into your KVN charter.

Anything the agent changed can be reversed. A turn that wrote something comes back with an undo handle, so a wrong move is a click away from being unwound rather than a cleanup project.

Action policies

Auto — the agent just does it.

Auto up to a daily limit — up to N times per day, then it starts asking.

Ask each time — the action is parked and waits for a human in Waiting for your approval on the same page.

Never — blocked outright.

A category with no policy setparks for approval. The default is fail-closed: silence means "ask me", never "go ahead". Widening a policy is a security decision — read the activity report first.

Guardrails

Escalation

The activity report

Anything the agent changed can be reversed. A turn that wrote something comes back with an undo handle, so a wrong move is a click away from being unwound rather than a cleanup project.