Approval-first, autonomy earned: how Claws decides what your agents can do without you

Inside the approval workflow: every action starts the same way

Nothing ships by default. Every action type an agent can take, sending an email, updating a record, posting a reply, starts approval-required, no exceptions on day one. You approve from the dashboard, or just by replying in whatever channel the Orchestrator already messages you on. There's no separate app to check, no queue you have to remember to look at.

This isn't one dial for the whole Claw either. A Sales Machine sending follow-up emails and that same Claw updating a CRM record are two separate action types, each earning trust on its own. Clearing one doesn't quietly extend it to the other.

How autonomy is actually earned

Approval isn't a permanent tax. Each action type earns auto-mode on its own, once it clears a streak of approvals across multiple distinct days, not just multiple attempts in one sitting. Say an agent's outbound replies get approved correctly for several days running. That specific action, sending that kind of reply, moves to auto. Everything else that same Worker touches stays exactly where it started, still asking.

One rejection during a streak resets it. The agent doesn't get to argue its way back to trusted status; it goes back to asking, and earns its way forward again from there. Autonomy in Claws isn't a setting you flip once. It's something a specific action type accumulates, and can lose.

What never graduates

Some actions don't get to earn their way to auto, no matter how long the streak runs. Money-moving and irreversible actions stay approval-required, permanently. It isn't only about money either. Anything that can't be walked back, a message sent to an entire client list, a record deleted instead of edited, gets the same permanent gate, whether or not dollars are involved.

Quant Trader is the clearest financial example: it's a research and signal intelligence tool, not a financial advisor, and it proposes trades by default rather than placing them. Even in the opt-in mode where it can execute within hard limits, every trade still passes through a separate, non-AI validation layer first, checking size, exposure, and daily loss limits before anything happens. That gate can't be prompt-injected or reasoned with, because it isn't the model making the call. Alerts stay on by default, and the hard limits stay in place regardless of how good the track record looks.

Testing before any of it is real

Two modes exist specifically so autonomy never gets earned on data you didn't choose:

• Test drive mode runs your whole team against sample scenarios with every external action blocked. It answers "what would this team do," with nothing real at stake.

• Shadow mode goes further. Inputs are live, real inbox, real records, but the output never leaves the draft folder. It answers a harder question: what would this agent have done with today's actual workload.

  
  

Together, they mean you've already watched the agent work, on real inputs, before its first approval ever counts toward anything. Underneath all of it, a hard budget cap warns you at 80% of your monthly limit and pauses everything automatically at 100%, whether or not any individual action has earned trust.

This isn't caution bolted onto the product after the fact. Every one of these mechanics exists because the alternative is guessing whether an agent deserves the trust it's about to get. An agent earns the right to act without asking again the same way a person would: by doing the smaller version of the job correctly, repeatedly, in front of you, first.