# Approvals and permission modes

> How Koshra's Allow, Ask and Block rules, approval cards and per-bot permission modes keep a person in charge of anything that goes out.

Canonical: https://koshra.si/docs/approvals
Last updated: 2026-11-07

Koshra drafts; you decide. Every tool call is checked against rules before it runs.

## Allow, Ask, Block

Each tool has a rule: Allow runs it, Ask stops for your approval, Block refuses it. Rules can be set for your account and for each space.

## Approval cards

When a rule says Ask, the bot pauses and an approval card appears with what it wants to do. You answer Allow or Deny. Web Push alerts can reach your phone, and the approvals inbox only shows cards to the space owner and admins.

## What configured rules hold

- The limited Plays email action, which needs explicit owner approval
- Creating a new bot, where that rule is configured
- Creating or changing a schedule, where that rule is configured
- Bulk CRM changes above the configured threshold

## What configured rules block

- Destructive CRM operations on the paths that implement the rule
- HubSpot and arbitrary CRM play writes, which are not supported
- Plays actions other than owner-staged email and typed Twenty company creation

## Permission modes

Each bot has a permission mode on top of the rules. A mode can make a bot stricter, never looser than the rules allow.