Modes & Approvals

Modes control how actions execute. Town provides multiple layers of control — from routine-level defaults to per-tool settings to session-level overrides.

Session permission settings

When chatting with your assistant, you can control how much autonomy it has for the current session.

Setting	What it does
Ask before any changes	Default. Every action that makes a change requires your approval first.
Always allow safe actions	Automatically approve low-risk actions. Actions that communicate externally still require approval when sensitive conditions are present.
Allow all actions	Full autonomous mode for this session. No approvals required for any action.

When you’re asked to approve

When your assistant wants to take an action, you have these options:

Option	What it does
Allow once	Approve just this one action
Always allow [this action]	Automatically approve this type of action for the rest of the session
Allow all actions	Switch to full autonomous mode for the rest of the session

Session permissions reset when you start a new chat. They don’t change the routine’s permanent settings.

Routine modes

Every routine has a default mode that controls how it handles actions.

Autonomous mode

Actions execute immediately without asking for approval.

What happens:

Reading actions run immediately
Actions that make changes also run immediately
No approval requests sent
Fastest execution

Best for:

Well-tested, trusted routines
Low-risk actions (labeling, archiving)
High-frequency triggers (processing every incoming email)
Routines that only report information to you

Autonomous mode can affect many emails quickly. Use it for low-risk actions and well-tested routines.

Approval-required mode

Actions that make changes wait for your approval before executing.

What happens:

Reading actions run immediately
Actions that make changes create approval requests
You receive notifications with approve/reject options
Actions only execute after you approve them

Best for:

New or untested routines
Routines that send emails or messages
High-stakes automations
Routines that access external communication tools

How approvals flow:

Read-only mode

The routine can only read and analyze — it cannot modify anything.

What happens:

Reading actions run normally
Actions that make changes are blocked
Cannot label, archive, or send
Can still send reports to you (since that only goes to your inbox)

Even in read-only mode, your assistant can still send you emails with results and summaries. It just can’t modify your inbox or message external parties.

Best for:

Analytics and reporting routines
Research routines
Testing new configurations
Routines that only gather information

Per-tool permission levels

You can override the mode for individual tools within a routine. This gives you fine-grained control.

Example: You want a routine that automatically labels and archives emails, but always asks before sending an email. Set the routine to autonomous mode, then override the email-sending tool to require approval.

This way, labeling and archiving happen instantly, while sending emails always waits for your OK.

Use per-tool settings to create nuanced permission models. For example, allow all reading and organizing actions but require approval for any external communication.

Where to find these settings

Per-tool permissions live in the Tools and Permissions panel:

For your assistant: go to Assistant Settings → Capabilities and Behaviors → Tools and Permissions.
For a routine: open the routine and go to its Tools and Permissions panel.

The panel lists every tool the assistant (or routine) can use, grouped by category — Email, Calendar, Google Drive, Web Search, Code, and so on. Select any tool to set its Approval mode:

Approval mode	What it does
Auto	Use the default mode for the routine (or assistant). The tool follows whatever the overall setting is.
Ask each time	Require your approval before each use.
Always allow	Run without asking. The tool executes immediately every time.

The Tools and Permissions panel, with tools grouped by category (Email, Calendar, Google Drive, Web Search, and more) on the left and a selected tool showing the Auto, Ask each time, and Always allow approval modes.

Tools that can send data outside Town are flagged when a combination looks risky — for example, when the same routine can read private data, take in untrusted input, and send externally. Town surfaces these “unsafe combinations” when you save, so you can decide deliberately. See the lethal trifecta for the full explanation.

Making your assistant more autonomous

If you find yourself approving the same actions over and over, set the tools you trust to Always allow. This is the most direct way to give your assistant more autonomy: it stops asking for those specific tools and just runs them.

A common setup:

Set low-risk tools — web search, reading email, viewing your calendar, creating drafts — to Always allow so the assistant moves fast.
Keep anything that sends externally — sending email, calendar invites, Slack messages — on Ask each time until you’re confident.

Always allow means no approval prompt. Reserve it for tools and routines you trust. For anything that contacts other people, leave Ask each time in place — sent messages can’t be unsent.

Meetings with other people use the Scheduling tools

When a meeting involves other people and your assistant is already working out a time across everyone’s calendars, it doesn’t book with the plain calendar tool. Town deliberately steers that booking to the scheduling engine, which re-checks the time against everyone’s availability before writing the event — so the invite is sent by Commit Scheduling Session, not Create Calendar Event.

That means setting Create Calendar Event to Always allow does not stop approval prompts for those invites. To let your assistant book and send them without asking:

Go to Assistant Settings → Capabilities and Behaviors → Tools and Permissions.
Open the Scheduling category.
Set Commit Scheduling Session to Always allow.

Committing a scheduling session invites every participant on it. Set it to Always allow only if you’re comfortable with invitations going out without your review.

What counts as a “safe” action?

When you select “Always allow safe actions”, Town automatically approves actions that can’t send data outside your account. Actions that can communicate externally still require your approval.

Automatically approved:

Reading and searching emails
Adding and removing labels
Archiving and moving emails
Creating drafts
Viewing calendar events
Reading files

Still requires approval (external communication):

Creating calendar events with attendees (sends invitations)
Editing calendar events (can notify attendees)
Sending Slack messages
Creating GitHub commits or pull requests
Updating shared Google Sheets or Docs

Sending an email to yourself (“send email to user”) is considered safe because it only goes to your inbox — not to anyone else.

Which actions require approval?

In approval-required mode, all actions that make changes require your approval:

Action	Needs approval?
Reading an email	No
Searching emails	No
Viewing calendar events	No
Adding a label	Yes
Archiving an email	Yes
Creating a draft	Yes
Deleting or trashing	Yes
Sending email to you	Yes
Creating calendar events	Yes
Sending Slack messages	Yes

Approval notifications

When a routine needs your approval:

In the web app — Visible in the chat and on the Approvals page
Email notification — You receive an email with the proposed action
Action options — Approve once, approve for the session, or switch to full autonomous

Each approval includes:

Which routine is requesting
What action it wants to take
The routine’s reasoning
Options to approve with different scopes

Clearing a backlog of approvals

If pending requests have piled up across several sessions, you don’t have to work through them one at a time. The header of the Notifications page — and the notification bell in the sidebar — has three actions that apply to every pending request at once:

Action	What it does
Allow all (Approve all in the bell)	Runs each pending action once. It doesn’t change any session’s permissions, so the next request still asks. On the Notifications page it skips requests to answer another person’s assistant, so you can review those replies individually — the bell’s Approve all sends them too.
Reject all	Turns the requests down. Those actions don’t run, and the routines waiting on them carry on without them. On the Notifications page, turning down a request to answer another person’s assistant also lets their assistant know you declined; from the bell it doesn’t.
Dismiss all	Clears them from your notifications only — nothing is approved or rejected. The requests stay pending and their sessions stay paused until you answer them in the chat.

Each one asks you to confirm first, and none of them can be undone. On the Notifications page a large backlog is processed in batches, so if part of it fails you’ll see how many were handled and the rest still go through. From the bell, Approve all and Reject all are sent as one request, so a big backlog is best cleared from the page.

Progressive trust

A common pattern is to start restrictive and expand trust over time:

At the routine level

Start with Read-Only — See what the routine would do without any risk
Move to Approval-Required — Let it propose actions for your review
Promote to Autonomous — When behavior is stable and low-risk

Within a session

You can progressively expand trust during a single session as you gain confidence in what the routine is doing.

Choosing the right mode

Situation	Recommended mode
Brand new routine	Approval-required or Read-only
Routine sends external messages	Approval-required (at least initially)
Simple labeling and archiving	Autonomous (once tested)
Research and analysis only	Read-only
Processing every incoming email	Autonomous (for speed)
Weekly summary routine	Approval-required (review before sending)
Mission-critical automation	Approval-required (even when trusted)

Best practices

Default to approval-required for new routines. Move to autonomous only after reviewing several runs.

Keep outgoing messages on approval-required. Sent messages can’t be unsent. Review before sending.

Use read-only for experimentation. When testing new instructions or configurations, read-only mode prevents accidents.

Check your approvals regularly. Approval-required only works if you actually review the requests. If they do pile up, see clearing a backlog of approvals.

Use “Always allow [action]” to speed up repetitive tasks. If a routine needs to archive 50 emails, approve the first one with “Always allow Archive Email” instead of clicking 50 times.