Skip to main content

Automations & approvals

Event automations wake an agent when an external event arrives (for example a Slack message or store order). They run in-process and do not require Kubernetes. Enable with Automations:Enabled and a public webhook base URL.

UI: Run → Automations, plus Integrations → Accounts and the approvals inbox.

Setup flow​

  1. Create a config agent (system prompt + MCP/tool intent).
  2. Create a connection for the external app; store the webhook secret.
  3. Create an automation linking project, agent, connection, event type, and instructions.
  4. Choose an execution mode:
    • Observe — watch only
    • Draft — draft internally; nothing leaves
    • ApproveWrites — mutating/external actions need human approval (recommended default)
    • ScopedAutonomous — granted actions may run within grant limits
  5. Add grants (tool name, action class, resource pattern, max calls, approval flag).
  6. New automations start paused — review grants, then toggle active.

Events & approvals​

  • Events inbox — deliveries, dead letter, replay, ignore.
  • Test (Development) — signs a payload with the connection’s secret so you can hit the real webhook gateway.
  • Approvals — approve or reject pending write/send actions; a second approve is rejected (exactly once).

Webhooks post to POST /api/integration-events/{provider}/{connectionId}. Unknown connection and bad signature both return 401 (no connection-id oracle). Duplicates are acknowledged without side effects.

Tips​

  • Treat webhook secrets like passwords; rotate if exposed.
  • Prefer ApproveWrites for anything that sends customer-facing messages.
  • Design handlers to tolerate at-least-once delivery even though the platform dedupes.