Checkpoints and the floor

A checkpoint is where an agent stops and asks a person before going on. It is filed as a request in the Inbox with the exact action, a preview, the cost and who can decide. The delegation waits in the Waiting on you state until someone answers.

How an action is settled

Before every tool call, the policy engine looks at the call's risk level, the agent's policy, the delegation's toggles, the workspace's data boundaries and the spend so far. It works through five layers in order and stops at the first that applies.

1. The floor. Actions on the list below always need a person.
2. Denies. A destination not on the agent's allowlist, a scope that was not granted, or a call outside allowed hours is refused outright, and the agent is told which rule refused it.
3. Delegation toggles. Ask before anything leaves the workspace; ask before spending over a set amount.
4. The agent's policy. Per-risk defaults set by an owner or admin.
5. Budget. A checkpoint at 80 percent of the cap, a hard stop at 100 percent.

The result is allow, checkpoint or deny, with the rule that produced it. The rule is stored on the request and in the activity log, so every card can say why it exists.

The floor

These actions never happen without a person, whatever the policy says and whoever set it:

• first message to anyone outside the workspace in a delegation
• moving money or issuing refunds or credits
• deleting or overwriting records the agent did not create
• changing roles, permissions or its own policy
• connecting an integration or widening scopes
• accepting terms, signing anything or making a purchase
• publishing publicly
• acting in another workspace

And one rule for every agent: its first run is draft-only.

Risk levels

read

Looking something up. Allowed by default within granted scopes.

write

Creating a draft, a label or a record inside the workspace.

external_send

A message or reply that leaves the workspace.

spend

Anything that costs money beyond the run itself.

destructive

Deleting or overwriting.

admin

Roles, permissions, policies, integrations.

Tightening and loosening

Anyone who can delegate can tighten a single delegation with its toggles. Only an owner or admin can loosen an agent's policy, and never below the floor. Nothing an agent says or writes can change its policy, grant a scope or approve its own request; approvals exist only as answers given by people.

Expiry and escalation

A request expires after seven days by default. A checkpoint left past its deadline escalates to the next approver, then the delegation pauses. Silence never means yes.

Preview: the policy engine and the floor are part of the backend now being built. The demo app shows checkpoint cards as they will appear.