/
Menu

Playbook proposals

How an agent proposes a key rotation or leaked-key response, what you approve, and which steps an agent may run.

An agent can propose a playbook for one item. You decide whether to run it. Every step that touches a value runs on your device.

#What an agent can propose

An agent cannot propose any other playbook, and cannot propose shutting a product down.

The proposal is for one item, one the agent got a reference to through an approved request. Free: only your first connected agent can propose. Solo: any connected agent.

#Approve or deny a proposal

  1. Open the approval link the agent shows you. It works for 10 minutes. The Agent proposal page shows:
    • Agent, Wants to run (the playbook), Project and Item.
    • Agent says:, the agent's own words, as plain text.
    • Expires, a countdown.
  2. Read the warning. Only approve if you just asked your agent for this.
  3. Under What your agent may do, choose which steps the agent may run (Solo only, see below).
  4. Choose Approve with passkey and complete the passkey check, or choose Deny. Denying needs no passkey check.

Approving starts the run on your device and shows it on the same page. The run is also saved in your vault. The agent is told only that you approved, and gets references and the steps you allowed. It never gets a value.

If the item or project doesn't match what the agent said, or a run is already in progress, the page tells you and you can only deny.

#Which steps an agent may run

On Free, the agent can propose, but you run every step yourself.

On Solo, you can let the agent run steps that don't involve a value:

  • Redeploy a deploy target.
  • Verify that the new key works.
  • Revoke the old key. This is marked Destructive.

Steps are ticked by default except revoke. Untick anything you want to do yourself. The agent can run only the steps you leave ticked, and only when their turn comes. If none of a run's steps are ones an agent can do, you run them all.

#Revoke needs your passkey again

Even when revoke is offered, the agent can't run it until you say so. On the run, the Your agent panel shows each step's status. Choose Allow the agent to revoke and complete a passkey check. You can take it back with Withdraw permission.

The panel uses short statuses such as "Ready: the agent may run it", "Allowed by you: the agent may revoke now" and "The agent reported it done". What an agent reports is a note for you, not a fact: your device decides what it means.

#What happens next

The agent reports each step as done or failed with a short note, up to 5 times per step. You see the reports on the run. An approved proposal stops accepting reports after 7 days, or when you finish or abandon the run.

#Limits

  • An agent can have 3 proposals waiting and make 10 an hour.
  • An agent's notes are checked for anything that looks like a key and refused if so.