AI that asks before it acts.
Teammates can read freely. Anything that would change another tool waits for a person, who sees exactly what will happen. Try it on the right: approve the message, or reject it.
- Document Chaser started workingStarted by a schedule · 1st business day, 09:00
- Checking connectors and preparing toolsSlack
- Document Chaser wants to post message in SlackWaiting for your approval
The run pauses. You decide. It runs once, or not at all.
The teammate wants to act
It wants to post to Slack, update HubSpot or write a Gmail draft: something outside TaskCrew.
The run pauses and asks you
The request appears in your Inbox and on the run timeline, with the exact arguments it will use.
Approve, or reject with a note
Approve and it runs once. Reject and it never does. No answer within 30 minutes means no.
Written into the product, not a policy page.
These are how approvals behave in the code that runs your teammates, on our cloud and on your own servers alike.
| On by default | Every new AI teammate starts with “Ask before acting” switched on. |
|---|---|
| Reading is never blocked | Searching, reading a CRM record or a page runs straight away. Only actions the tool doesn’t mark read-only wait. |
| Exact arguments | You see precisely what will run. Arguments can’t be edited, and each request is decided once. |
| Only people decide | Never approved by an AI teammate or an API token. |
| No one-click links | No approve links in email or Slack. You decide inside TaskCrew. |
| Time limit | Rejected automatically after 30 minutes without an answer. |
| On the record | Every request and decision, with who and when, is in the audit log. |
If a teammate is tricked by something it reads, it still can’t reach your keys or the internet.
Each run gets its own container with no network and no secrets. Everything it does goes through the runner, which holds the keys and logs every call.
The sandbox: one per run
- The AI agent loop and the task it was given
- Tool descriptions, never credentials
- No network at all
- No secrets, keys or tokens
- Read-only file system, memory, CPU and time limits
no network
The runner holds the keys
One container per run
Nothing is shared between runs. A non-root user, all capabilities dropped.
No network
The sandbox has no network. Every model and tool call is brokered and allow-listed.
No secrets inside
The model key and OAuth tokens live only in the runner, never in the sandbox.
Tested for escapes
An escape test checks network, file access, child processes and secrets are blocked.
A monthly limit that AI can’t run past.
Set a monthly limit in dollars. Owners and admins are warned at 80% and 100%. At the limit, new runs pause until the 1st of next month or until an admin raises it. Members see tokens; only admins see cost.
Some things are off limits, by design.
What a teammate can see
- The task it was given, its comments and attached files
- What workspace tools return for the person who started it
- Connectors you allowed for that teammate
What it never sees
- Password vaults: not to AI teammates, MCP, search or exports
- Anyone’s My space, the private project not even admins can open
- Projects and items the person asking can’t open
- API keys and connector tokens, which never enter the sandbox
A record the AI can’t edit.
Every tool call, with its arguments, results and timing, is written by the runner, not the AI, so a teammate can’t skip or fake an entry. Owners and admins filter the audit log by person, project, kind and date, and download it as CSV.
| When | Who | What |
|---|---|---|
| 09:02 | 📬 Document Chaser | search · read-only · 0.3 s |
| 09:02 | 📬 Document Chaser | Asked to post message in Slack |
| 09:06 | Fatima | Approved |
| 09:06 | 📬 Document Chaser | slack__post_message · 0.4 s |
| 11:40 | 🕵️ Lead Researcher | Rejected by Sara |
Approvals, answered
Can I turn approvals off?
“Ask before actions that change things outside TaskCrew” is a setting on each AI teammate, and it is on for new ones. You can turn it off for a teammate you trust with a connector, and back on at any time.
Who can approve?
People who can edit the task. Never another AI teammate, never an API token, and never a link in an email or a Slack message: you decide in TaskCrew, in the Inbox or on the run timeline.
What happens to the run while it waits?
It stays running, with its time limit paused. Its sandbox is kept but doesn’t count against capacity. Reading and thinking were already done; only the action waits.
What happens if I reject?
The action never runs, and the teammate is told it was declined, with your reason if you gave one. It finishes the task without it, and says so in its result.
What if nobody answers?
After 30 minutes the request is rejected automatically. Self-hosted servers can change the time with AGENT_APPROVAL_TIMEOUT_SECONDS.
Can someone change the arguments before approving?
No. You approve exactly what will run, or reject it. That keeps the audit log true: what was approved is what ran.
Delegate to AI without handing over the keys.
Approvals, the sandbox and the spend limit are on every plan, including Free.