> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leme.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions & approvals

> Decide what agents can do freely, what needs a human, and what is off

Every connection has an **Agent permissions** panel that answers one question: *what can agents do with this tool?* Actions are grouped by risk — not by feature — and for each group you pick one of three verdicts:

| Verdict          | Meaning                                                                         |
| ---------------- | ------------------------------------------------------------------------------- |
| **Allow**        | The agent does it on its own.                                                   |
| **Ask approval** | The agent can do it, but a human must approve each time.                        |
| **Never**        | Off. The capability doesn't exist for agents — they can't see it or attempt it. |

## Risk categories

Grouping by risk means you reason about blast radius, not about individual features. Creating an internal ticket and sending a customer an email are both "creating something" — but they deserve very different rules.

| Category                   | Covers                                      | Default      |
| -------------------------- | ------------------------------------------- | ------------ |
| **Read**                   | Listing, searching, looking things up       | Allow        |
| **Write**                  | Creating and editing records in the tool    | Ask approval |
| **External communication** | Messages and emails to people               | Ask approval |
| **Public publishing**      | Content visible outside your organization   | Ask approval |
| **Destructive**            | Deletions and irreversible changes          | Never        |
| **Payments**               | Charges, refunds, payouts                   | Never        |
| **Administration**         | Managing the tool's members and permissions | Never        |

Defaults are safe out of the box: a freshly connected tool lets agents read, asks a human before changing anything, and keeps dangerous capabilities off. Some integrations suggest stricter defaults that fit their nature.

For the highest-risk categories — payments, destructive actions, public publishing, administration — **Allow is not available**. The most you can grant is *Ask approval*: a human is always in the loop for these.

<Note>
  **Replying doesn't need a permission slip.** By default, an agent may answer in the conversation it was called in — the Slack thread, the email thread — without approval. Messaging any *other* destination follows the External communication verdict. You can turn this exception off per connection.
</Note>

## Per-action exceptions

The category verdict is usually all you need. For specific cases, you can override a single action: allow one routine write while the rest of the category asks for approval, or shut off one action entirely. Exceptions follow the same rule as everything else — they can loosen within limits, but the high-risk categories still never reach plain Allow.

## How approvals work

When an agent reaches an action that requires approval, it doesn't do it — it asks:

1. The run pauses and an approval request is created, showing what the agent wants to do and with which tool.
2. Approvers are notified. By default, `Owner` and `Admin` can approve; approval policies can route specific decisions to specific people or teams.
3. **Approve** and the agent continues exactly where it stopped. **Deny** and the agent moves on without the action, telling the person it's working with.

Approvals apply everywhere — conversations, [triggers](/triggers), and [API runs](/api/runs) all follow the same rules. There is no side door.

## Auditing

Every action an agent takes, every approval decision, and every change to permissions is recorded — what happened, who decided, and when. Changes to permissions take effect immediately.

Permissions are managed by `Owner` and `Admin` roles, per connection, in **Integrations → the connection → Agent permissions**.