SyntrumDocs
Open app

Supervision & modes

A supervision mode is the single dial that decides how much an agent may do without you. It sits between the workspace safety floor above it and each tool's permission below it, and it answers one question: when this agent wants to make a change, does it just do it, or does it ask first?

You set the mode in the agent's Permissions tab (or the Mode picker in its control bar). See The agent workspace.

The four modes#

Mode What it does
Inherit Follows the workspace policy — updates automatically when the workspace changes. This is the default.
Strict Every write goes through approval. Reads still flow.
Balanced The workspace's sensitive-action rules apply as-is.
Autonomous Acts on approval-level categories without asking. Blocked categories stay blocked.

The guiding principle, printed right on the Permissions tab:

Reads always flow; supervision only gates writes. The workspace policy is the floor, the mode is the dial — and block never loosens. No mode, not even Autonomous, can turn a workspace block into an allowed action.

How to read each mode#

  • Inherit — the agent has no opinion of its own; it does whatever the workspace guardrails say. Change the workspace floor and this agent moves with it. Best default for most of your team.
  • Strict — maximum oversight. The agent can observe and draft freely, but every side-effecting action becomes an approval. Use it for a new agent you're still learning to trust, or a high-stakes role.
  • Balanced — the agent runs the workspace's sensitive-action policy exactly as configured: allowed categories run, approval categories ask, blocked categories refuse.
  • Autonomous — maximum independence within the floor. Anywhere the workspace says "approval," the agent just acts; anywhere the workspace says "block," it still can't. Use it for well-proven, low-risk agents.

Pinned vs. Inherited#

By default an agent's mode is Inherited from workspace — it tracks whatever the workspace default is. The moment you pick a specific mode for the agent, it becomes Pinned on this agent: it stops following workspace changes and holds the mode you chose.

  • A Pinned chip appears next to the mode picker (in both the control bar and the Permissions tab) when the mode is set on the agent.
  • When inherited and the workspace default isn't plain Inherit, the picker shows the resolved value too — e.g. Inherit · Balanced — so you always know what's actually in effect.
  • Reset to workspace default (on the Permissions tab) clears the pin and puts the agent back on Inherit in one click.

Pins are meant to be deliberate and visible. If you're not sure why an agent behaves differently from the rest of your team, check whether its mode is Pinned — and reset it to re-sync with the workspace.

How the mode fits the cascade#

Supervision mode is the middle of three planes. Every action an agent attempts resolves through one cascade, evaluated server-side at the moment it tries to act:

Workspace floor → Agent mode → Tool pin, inherit by default, strictest wins, and block is a floor that nothing below can loosen.

  • The workspace floor is the Safety page — six sensitive categories, each allow / approval / block.
  • The agent mode is this dial.
  • The tool pin is the per-tool permission in Tool permissions, which can only tighten what the mode allows.

The full mental model lives in The three planes, and how approvals get generated is in Agent autonomy.

Test an action (the simulator)#

Before you trust a mode, dry-run it. The Test an action card on the Permissions tab lets you preview any decision with zero side effects:

  1. In the agent's Permissions tab, find Test an action.
  2. Pick a connected tool from the Pick a tool… dropdown.
  3. Type the action to test, e.g. GMAIL_SEND_EMAIL.
  4. Click Preview decision.

The result tells you exactly what would happen:

Result Meaning
allow Runs immediately — nothing holds it.
approval Parks as an approval card; runs on approve.
block Refused — a block rule stops it.

It also shows provenance — which level decided (workspace, agent, or tool) — and the underlying reasons. Nothing actually runs, so you can safely check how Strict vs. Autonomous, or a tool pin, changes the outcome before committing.

Changing an agent's supervision mode requires an Admin or Owner role. Operators and Viewers see the mode and can run the simulator's read-only preview, but the picker is disabled for them. See Team & roles.

What's next#