Autonomy is granted, never assumed.
An agent that can email your customers on day one is not a feature, it's a liability. So Brohns starts at the bottom rung and stays there until you decide otherwise — and you decide per kind of work, not once for everything.
Rung one: it proposes
This is where every account starts and where most work stays. Agents find, qualify, draft and prepare — and then stop. An outreach email, a reply to a customer, a quote, a client update: all of it sits as a draft with your name on the decision.
Work still happens while you sleep. What doesn’t happen is anything the outside world can see.
Rung two: you approve
Approvals arrive in one place with the context attached — the recipient, the full text, the rows it was built from, and the agent’s own reasoning for why now. You can edit before you send; the version you approve is the version that goes.
Batch approval exists for when a queue has built up, but it approves the drafts you can see, not a category you can’t.
Rung three: it earns a category
Autonomy is handed over per kind of work. Answering “where is my order?” from real order data is a very different risk from issuing a refund, and the ladder treats them differently.
Where auto-reply is available, the categories it may cover are fixed on the server, not in your settings. Money, complaints, cancellations and address changes always wait for a person. Your configuration can narrow that list — never widen it — and it also holds a daily cap, only replies grounded in real data, and never replies to a message that looks like it’s trying to talk the agent out of its instructions.
What the guardrails check at the last moment
Approval isn’t the final gate; the send path is. At the moment of sending, Brohns re-checks your do-not-contact list, your sending window in your own timezone, and your daily limit — and it loads the recipient and the content from the database rather than from whatever the browser posted.
So a draft approved yesterday for someone who unsubscribed this morning does not go out.
Taking a rung back
A granted category can be switched off at any time, and it takes effect on the next action — there is no notice period and nothing “already scheduled” that slips through, because scheduling isn’t what sends. If you’d rather stop everything at once, switching the agents off leaves the drafts intact and simply stops new work.
Everything is written down, including the noes
Each attempt lands in an append-only trail: what was done, over which channel, whether it succeeded, and why it was refused if it wasn’t. A blocked send is a recorded event rather than silence — silence and a bug look identical, and only one of them is fine.
The same trail records who acted. In a workspace, agents always act as the owner, but the team member who pressed the button is named in the record.