The approval-first approach: staying in control of AI that acts for you

There is a hard line running through everything an AI agent does. On one side is reversible work: searching, reading websites, scoring, qualifying, drafting, planning. If an agent gets any of that wrong, you delete the draft and nothing has happened. On the other side is irreversible work: an email that lands in a real inbox, a post that goes public, money that leaves an account. A mistake there isn't a bad draft — it's a damaged relationship, a compliance problem, or a bill.

Language models are now good enough to do the reversible side at scale, and still not reliable enough to be trusted with the irreversible side unattended — at least not on day one. They occasionally misread context, address the wrong person, or invent a specific detail that sounds plausible. In a document, those errors get caught in review. In a sent email, they get caught by the recipient.

Approval-first design takes that line seriously and builds the whole product around it. Agents run freely on the reversible side: they can source a hundred leads, qualify each one with a written reason, and draft every message without asking permission. The moment work would cross into the world, it stops and waits for you. Reviewing thirty finished drafts takes a fraction of the time writing them would — so you keep the leverage of the agents while keeping your name on the decision.

Plenty of tools describe themselves as human-in-the-loop, but in many of them the loop is a confirmation dialog in the browser. The agent composes a message, the interface asks "send this?", and a click passes the agent's output straight to a send function. That is a UI courtesy, not a control. If the agent gets manipulated — say, by a prompt injection hidden in a scraped webpage — or if there is simply a bug, nothing on the server actually stops the send.

In Brohns, approval is enforced where it cannot be bypassed. When you approve a message, the server re-reads the recipient and the content from the database — the exact record you just reviewed — runs it through the guardrails, sends it, and writes the action to an audit log. There is no code path where a model's output flows directly to the outside world. The model proposes rows in a database; only your approval, verified server-side, turns a row into an action.

That distinction sounds technical, but it changes what the system can and cannot do to you. An agent cannot talk itself into sending something. A poisoned prompt cannot smuggle out a message. And what you approved is provably what went out, because both came from the same stored record.

Approval is necessary but not sufficient, because people make mistakes too — you might approve a batch late on a Friday, or miss that someone once asked never to hear from you again. So a second layer of limits applies to every message, including the ones you have already signed off on. These are checks the server runs at send time, not policies you have to remember:

Beyond the send-time checks, two structural details matter for trust. Everything goes out through your own sender — a Resend API key or your Gmail account connected via OAuth — so Brohns never emails anyone from its own domain on your behalf, and your deliverability reputation stays yours. Those credentials live in an encrypted vault, and every approved action is recorded in an audit log: what went out, to whom, and when. If you ever need to reconstruct a campaign, the record exists.

Approval-first does not mean approval-forever. Brohns starts every new agent team at the bottom of an autonomy ladder: everything outward waits for you. That is not a statement about the agents being untrustworthy — it is an acknowledgment that trust needs evidence, and on day one there is none.

The evidence accumulates in your approvals queue. Early on, you will edit drafts — tightening a subject line, cutting a sentence that oversells. Each edit does double duty: the corrected version is what actually goes out, and the agent distills your change into a lasting lesson, so the next draft needs less of you. When drafts consistently ship without changes, that is your signal to climb the ladder: you can grant routine autonomy per ecosystem, letting a team act independently within its limits, around the clock.

The ladder runs both ways. You can step any team back down to approve-everything at any moment — after a campaign pivot, a new audience, or just a gut feeling — and there is a kill-switch that halts a team outright. Autonomy here is a dial you turn deliberately, not a door that locks behind you.

Fast, confident approval depends on context, and context is exactly what most automation hides. Brohns takes the opposite stance: every agent action lands on a visible timeline, and nothing happens silently. If a Finder sourced twelve businesses this morning, that is on the record before you ever think to ask.

More unusual: you can watch agents think. Each agent shows its real reasoning live — the actual thinking behind a decision, never a canned status message. When the Qualifier scores a lead's website, it writes down why that lead is or is not worth pursuing, in plain sentences you can disagree with. Outreach drafts even pass a second, stricter review that hunts for invented specifics, hype, and filler before they reach your queue at all.

This is what keeps the approvals queue quick instead of becoming a chore. Every waiting draft arrives with its "why" attached — which real finding the opening line is built on, how the lead qualified. You are not auditing a black box; you are skimming an argument. Most decisions take seconds, and the ones that don't are precisely the ones that deserved your attention.

A concrete week looks like this: you describe a goal in plain language, Bro proposes a small team — usually two to seven agents, each with one sharp responsibility — and you approve that design before anything runs. The team then sources, qualifies, and drafts on its own. Once a day you open the queue and work through the proposals: approve, edit first, or dismiss, one tap each. If you are new to running agents, our guide to your first week with an AI agent team walks through this rhythm day by day, and the lead-generation use case shows the deepest version of the workflow.

The pricing follows the same philosophy. Credits are spent only when an agent actually does work — finding and scoring a batch of leads costs 5 credits, a drafted message 3, sending an approved message 1 — while approvals, edits, and incoming replies are free. Reviewing carefully costs you nothing, so the economics never nudge you toward rubber-stamping.

That is the whole approach: agents that move fast on everything reversible, a server that refuses to let anything irreversible happen without your signature, and enough visibility that giving it takes seconds. Every account starts with a 14-day free trial and 500 credits, no credit card required — enough to run a team through a full cycle of finding, qualifying, drafting, and approving before you decide how much rope to give it.