Approvals

A required gate before any `live` action that consumes credits or writes externally.

An approval is explicit human confirmation before live work spends credits or writes to an external system.

What requires approval

Action	Approval required
Paid provider call, or a tool that writes outside OXYGEN (`oxygen tools run --mode live`, MCP `oxygen_tools_run_live`)	Yes — a paid call also needs `--max-credits`
Column or table run on an AI, research, tool, or enrichment column	Yes — `--approved` with `--max-credits`
Enrichment run (`oxygen enrich-column run`)	Yes — every run; preview first (free)
Live workflow call or event emit (`--mode live`)	Yes — `--approved` and `--max-credits`, even when the graph only reads
Sequence launch (`oxygen sequences start`)	Yes — `--approved`, plus `--max-live-sends` when the sequence has email, WhatsApp, or CRM-task steps
Sequence enrollment (`oxygen sequences enroll`)	No — free; an active sequence contacts new leads on its next tick, under its launch approval
Publishing a post	Yes — approval binds the exact copy; any content edit needs a new one (Publishing)
LinkedIn engagement, CRM sync, or pushing leads into an external campaign	Yes
Immediate permanent purge (`tables delete --now`, `columns delete --now`)	Yes — free but irreversible: refuses with a preview until re-run with `--yes`
A live tool call that is free and only reads	No
`dry_run` / `smoke_test` anything	No
Read-only commands (`tables query`, `cells inspect`, etc.)	No

Approval gates are not only about money: a free action that irreversibly destroys workspace data (like an immediate purge) sits behind the same preview-then-approve pattern as paid spend. The default tables delete path needs no approval because it is reversible — the table stays restorable until its scheduled purge.

What to review

Before approving live work, check:

Field	What to confirm
Scope	Table, column, workflow, filters, row ids, and row count
Provider or integration	Which tool, CRM, outbound system, or social action will run
Mode	`live`, not `dry_run` or `smoke_test`
Credit ceiling	The `--max-credits` value you are about to authorize
Preview	Sample inputs/outputs or a preflight result
Destination	External account, campaign, list, CRM object, or table column

CLI and MCP responses include structured JSON and often a web_url; use the web view or widget to inspect the same run before continuing.

CLI patterns

oxygen tools run <tool-id> --input-json '{...}' --mode dry-run --json
oxygen tools run <tool-id> --input-json '{...}' --mode live --approved --max-credits 5 --json

oxygen table-runs create <table-id> --column <column-key> --limit 100 --approved --max-credits 100 --json

oxygen enrich-column preview <table-id> --capability work_email --limit 100 --json
oxygen enrich-column run <table-id> --capability work_email --limit 100 --approved --max-credits 100 --json

oxygen workflows call <workflow> --input-json '{...}' --mode dry_run --json
oxygen workflows call <workflow> --input-json '{...}' --mode live --approved --max-credits 100 --json

--mode is required on every workflows call except a --preview, which runs nothing; a live call also requires both --approved and --max-credits.

Without --approved, oxygen enrich-column run fails with approval_required (exit 7) and spends nothing.

For generated-message review queues, use:

oxygen reviews next --json
oxygen reviews accept <review-id> --json
oxygen reviews reject <review-id> --auto-rerun --json

Review queues are for human-in-the-loop content such as AI-generated outreach, not a replacement for preflighting paid provider runs.

Where pending items are decided

Waiting on a decision	Decide it
A Workspace Copilot approval card	Approve or Reject on the card, or `oxygen copilot approve <session-id> <approval-id>` (add `--reject` to refuse). A chat set to Auto-approve raises no cards — see Copilot approvals.
An Agent tool call paused by an `ask` rule	Approve and resume or Reject in the run transcript, or `oxygen agent approval-decide` — see Agents.
A workflow run at an approval step, including a recipe's `ctx.approvals.require`	`oxygen workflows approvals` lists them; `oxygen workflows resume <run-id> --decision approve` (or `reject`) decides one and resumes the run.
A post waiting on approval	Approve… in the `/publishing` queue, or `oxygen publishing posts approve <post-id>` — see Publishing.
An AI reply draft	Approve & send, Edit, or Reject in the AI Sales Agent's review queue — see Handle replies.
A request for a named person's go/no-go	`oxygen approvals inbox`, then `oxygen approvals decide <request-id> --approve` — see Collaboration.

oxygen observability approvals --json lists the waiting workflow approvals, posts, message reviews, reply drafts, and second-party requests in one place, each with the exact command that decides it — see Observability. Agent pauses and Copilot cards are decided in their own run or chat.

Copilot approvals

In a Workspace Copilot or Oxygent chat, a paid step whose maximum quote (its max_credits ceiling) is under 100 credits runs without asking on every plan, and so do paid steps within your plan's approval-free allowance (Spend caps); the chat still tells you what each one cost. A larger paid step, a paid step with no quote, or anything that reaches outside the workspace — a send, a sequence start, publishing, a purchase, a sync — stops at an approval card: Approve runs it, Reject refuses it.

The approval menu in the composer, beside the model picker, sets how each chat asks:

Mode	What happens
Ask for approval	The default. Paid steps above the allowance, and every action outside the workspace, wait for a card.
Auto-approve	Never asks, even for paid actions or sends: every action that would raise a card runs without one, each still within its own credit cap and your balance. Turning it on also approves the cards already waiting in that chat. Restricted actions, such as credentials and billing, stay refused.

The mode belongs to one chat; a new Copilot chat starts with the mode you picked last in this browser. In an Oxygent chat your whole workspace shares, the mode is yours alone and starts on Auto-approve: it covers what you send there, never anyone else's messages, and their cards still ask them. A group chat with other people always asks each message's sender. Every auto-approved action is still recorded as an approval in the chat's event log (oxygen copilot get). From the CLI, oxygen copilot policy set --session-id <id> --auto-approve-policy paid (or off) changes a chat's mode, and oxygen copilot approve <session-id> <approval-id> decides a waiting card (--reject refuses it). MCP clients use oxygen_copilot_session_update with auto_approve_policy, and oxygen_copilot_approve.

Standing permissions

These grants let work run later without a per-delivery approval. Each is armed explicitly and stays bounded by a credit ceiling.

Standing grant	How it is armed	Bound to
Autonomous workflow trigger (cron, webhook, event) on a tool-calling workflow	`oxygen workflows enable <workflow> --approved --max-credits <n>`	That workflow revision — publishing a new revision needs `--approved` again
Agent trigger (cron, event, webhook)	`oxygen agent trigger-create` with `--max-credits` and `--approved`, both required	That trigger; each delivery spends at most its `--max-credits`
Table auto-run	`oxygen tables auto-run set <table> --columns <csv> --max-credits <n>`	The saved column set; rows written by import, insert, upsert, or webhook queue those columns
CRM record enrichment	`oxygen crm enrichment list`, then `oxygen crm enrichment enable <preset> --object <object>`	The saved enrichment set on that CRM object; every record written to it enriches, bounded per batch (`oxygen crm enrichment set --max-credits` changes the batch ceiling)
CRM sync	`oxygen crm sync enable` with `--approved`, `--max-credits`, and `--max-rows`	That object pair's scheduled sync, until `oxygen crm sync disable`
Publishing amplification	`oxygen publishing amplification enable <policy-id> --approved --acknowledge-risk`	That policy and its `--max-credits` — see Publishing
Copilot Auto-approve	The composer's approval menu, or `oxygen copilot policy set --session-id <id> --auto-approve-policy paid`	That chat; every action runs without a card, each within its own credit cap — see Copilot approvals

Where --max-credits is optional — a workflow trigger, a table auto-run, a CRM enrichment batch — leaving it out binds your plan's default per-delivery ceiling: a delivery or batch stops there. On a plan with no default, set an explicit ceiling. See Spend caps.

Modes — which modes require approval.
Spend caps — the credit limit attached to every approved run.
Runs — inspecting what an approved run actually did.
Collaboration — asking a second person to decide, and the gate that holds a launch until they do.