Skip to content

Approval Controls and Safety

GloriaMundo can pause selected sensitive actions during a live workflow and wait for your decision. This control uses a built-in sensitivity list together with the workflow's approval mode.

It does not apply a configurable policy or blocked-action check to every workflow step. Actions that are not in the sensitivity list do not enter the approval flow automatically.

The Live Approval Flow

When a live workflow reaches an action:

  1. GloriaMundo checks the action type against its built-in sensitivity list.
  2. If the action is not listed, the step continues without an approval pause.
  3. If the action is listed and the workflow uses Run without asking, the step continues automatically.
  4. If the action is listed and the workflow uses Ask me first, GloriaMundo saves a checkpoint and creates a pending approval request.
  5. Approving the request resumes the workflow from that checkpoint. Denying it stops the run.

Pending requests expire after 24 hours. The saved checkpoint lasts slightly longer so an approval can resume safely during that window.

Which Actions Are Classified as Sensitive?

The current live gate recognises these exact raw action names:

  • GMAIL_SEND_EMAIL
  • SLACK_SEND_MESSAGE
  • GITHUB_CREATE_ISSUE
  • GITHUB_CREATE_PR
  • HUBSPOT_CREATE_CONTACT
  • HUBSPOT_CREATE_DEAL
  • NOTION_CREATE_PAGE
  • NOTION_UPDATE_PAGE
  • EXECUTE_PYTHON
  • E2B_EXECUTE
  • STRIPE_CREATE_CHARGE
  • DEPLOY_PRODUCTION

The comparison is an exact, case-insensitive name match performed before legacy integration aliases are resolved. That means existing workflows using GITHUB_CREATE_ISSUE, GITHUB_CREATE_PR, or NOTION_CREATE_PAGE still enter the gate before those names are mapped to current Composio actions.

Being in this list does not guarantee that a downstream executor supports the raw name. In particular, normal Code steps do not supply an action name to this gate, so their code does not pause merely because EXECUTE_PYTHON and E2B_EXECUTE appear here.

This is not a general rule that catches every write, send, delete, financial, social, or code action. See Approval Modes for the same raw-name list grouped by risk level.

Choosing an Approval Mode

New workflows inherit the default approval mode from Settings. After completing a Virtual Run, you can change the mode for an individual workflow in the builder:

  • Ask me first pauses actions in the sensitivity list.
  • Run without asking lets those actions continue automatically.

Use Ask me first when you want a human decision at the selected sensitive-action boundary. Always inspect the workflow and complete a Virtual Run before enabling unattended execution.

Reviewing Requests

The Approvals page shows pending and resolved approval requests. A pending request includes the proposed action and its parameters so you can approve or deny it.

See Managing Approvals for the queue and history, or Approvals Overview for the checkpoint-and-resume flow.

Other Safety Tools

Approval controls complement, rather than replace, the other controls available in the product:

  • Virtual Run previews a workflow before live execution and simulates write operations rather than sending them.
  • Workflow run history records execution status and step results for inspection.
  • Credit and API spend controls help bound usage separately from action approvals.

These mechanisms have different scopes. Do not assume that an approval mode blocks every possible action.