Approvals
A required gate before any `live` action that consumes credits or writes externally.
An approval is explicit human confirmation before live work spends credits or writes to an external system. In practice, approval means the user can see the row scope, provider or integration, expected cost, and external side effect before the run proceeds.
What requires approval
| Action | Approval required |
|---|---|
Paid provider call (oxygen_tools_run_live) | Yes |
Column run on an AI/tool column with credits_used > 0 | Yes |
| CRM write, outbound enrollment, LinkedIn action, or campaign sync | Yes |
Workflow fire in live mode touching either of the above | Yes |
Workflow fire in live mode that only reads | No |
dry_run / smoke_test anything | No |
Read-only commands (tables query, cells inspect, etc.) | No |
What to review
Before approving live work, check:
| Field | What to confirm |
|---|---|
| Scope | Table, column, workflow, filters, row ids, and row count |
| Provider or integration | Which tool, CRM, outbound system, or social action will run |
| Mode | live, not dry_run or smoke_test |
| Credit ceiling | --max-credits or template --max-credits where required |
| Preview | Sample inputs/outputs or a preflight result |
| Destination | External account, campaign, list, CRM object, or table column |
CLI and MCP responses include structured JSON and often a web_url; use the web view or widget to inspect the same run before continuing.
CLI patterns
oxygen tools run <tool-id> --input-json '{...}' --mode dry-run --json
oxygen tools run <tool-id> --input-json '{...}' --mode live --json
oxygen table-runs create <table-id> --column <column-key> --limit 100 --max-credits 100 --json
oxygen workflows templates run <template-id> \
--input-json '{...}' \
--mode live \
--max-credits 100 \
--approved \
--jsonFor generated-message review queues, use:
oxygen reviews next --json
oxygen reviews accept <review-id> --json
oxygen reviews reject <review-id> --auto-rerun --jsonReview queues are for human-in-the-loop content such as AI-generated outreach, not a replacement for preflighting paid provider runs.
Standing permissions
By default, do not treat live paid work or external writes as background noise. Use dry-run/preview first, then approve a bounded live run.
Related
- Modes — which modes require approval.
- Spend caps — the credit limit attached to every approved run.
- Runs — inspecting what an approved run actually did.