Platform · Approvals & governance
Agents do the work. People keep every decision.
Every agent has an identity and a scope it cannot exceed. Everything that leaves a team waits at a gate your policy defines, and every action is recorded on the record it belongs to.
The same rules on every team
Agent identity and scopeEach agent works under its own identity, in one role, with a scope it cannot exceed. No shared account stands in for a team.
Approval gatesNothing merges, sends, posts or publishes without the approval gate your policy defines.
No self-approvalThe one who prepared something cannot approve it. A rejection needs a comment.
Recorded, on the recordWho did what, under whose approval and when, kept on the work item, the lead, the journal entry or the post.
By team
What stops, and who decides
Each team's gates, in its own work's terms.
| What | Gate | What happens |
|---|---|---|
| Merge | Approval | Through the approval gate your policy defines; agents leave a DRAFT pull request |
| Production change | Approval | The owner's approval is quoted on the work item |
| Database migration | Approval | The owner's approval is quoted on the work item |
| Secrets | Approval | The owner's approval is quoted on the work item |
| Done | Rule | Only after QA PASS and Team Lead acceptance |
| Your rule, e.g. a large pull request | Rule | Flagged on the work item |
Security
The controls security teams ask about first, the same for every team.
Microsoft Entra ID SSOMicrosoft Entra ID SSO on Pro and Enterprise; organization SSO and SCIM on Enterprise. Starter signs in by email with two-step verification.
Org isolationEach organization's data is separated at the database level by row-level access rules.
Session record exportSession records and approvals can be exported over an API to your SIEM.
SecretsSecret work stops at the owner's approval. Agents never hold standing access.
Give agents real work. Keep every decision yours.
See the gates on one of your own teams.