Can an agent send money or change a record on its own?
No. On Czar, the step that sends, spends, or changes a record always waits for a person. The agent drafts; a named reviewer decides; then the call is made or the run ends.
· 3 min read
IN SHORT
No. On Czar, the step that sends, spends, or changes a record waits for a person. The agent reads and drafts on the appliance, then holds at that step until a named reviewer sees the draft and what it used and approves or stops. Only after approval is the allowed call made. The waiting step is written into the version's bounds and a run cannot skip it.
No. An agent on Czar cannot send money, send a message, or change a record on its own. The step that would do any of those things is the step that waits. The agent reads what it may read, drafts, and then holds until a named reviewer sees the draft and what it used and decides. Only on approval is the allowed call made. On stop, the run ends with nothing sent.
This is not a setting. It is how a run on the appliance is shaped, and the version's bounds write it in.
Where the line sits
A run has steps that look and steps that act. Reading the packet, retrieving passages from the corpus, reading a record from a connected system to inform the draft: these are looking steps, and they happen within the version's bounds without a person. Sending the reply, posting the entry, changing the record, spending from an account: these are acting steps, and every one of them waits.
The line is drawn at the point where something outside the agent would be different afterward. Up to that point the agent has produced a draft and nothing else. Past that point a person has decided.
What the reviewer actually sees
The reviewer does not approve a summary or a confidence score. They see the draft itself, which is the content of the call that would be made, together with the passages from the corpus and the reads from connected systems that the agent used to produce it. If the draft proposes a payment, the reviewer sees the amount and the basis for it. If it proposes a change to a record, they see the change and what justified it.
The reviewer approves or stops. They cannot hand the agent a tool it does not have or widen what it may read. Their decision, their name, and the moment are written to the run record in sequence with the inputs and the draft. A reviewer can follow a run live as it reaches the waiting step or open a finished one later.
Why this holds for every agent
The waiting step is part of every version, and a version cannot be edited after publishing. An operator composing an agent decides where else a person must approve and who the reviewer is, within what the admin allows, but the step that sends, spends, or changes a record waits regardless. There is no quiet path where a version is published without it.
The admin's decisions reinforce this from the other side. An agent can only name as a tool a system the admin has made available, so the systems an agent might act on are a list someone wrote. And every call that is made, after approval, is on the record with what was sent and who approved it.
A site adopting agents on Czar does not have to trust the agent's judgment about when to act. The agent never makes that judgment. For how the roles divide this responsibility, see /governance.
Questions this raises
- Could an operator design a version with no approval step before a payment?
- The step that sends, spends, or changes a record waits for a person; that is how the agent layer works rather than a setting the operator chooses. The operator decides where else approval is required and who the reviewer is, not whether that step waits.
- What if the reviewer is slow to respond?
- The run holds at the waiting step until the reviewer reaches it. Nothing is sent and nothing changes in the meantime. The desk's application that called the address sees the run as waiting, the same way it would see a request waiting for a signature.
- Does approval apply to reads as well as writes?
- Reading is governed by the bounds, which say what material and which systems the agent may read, and a read within bounds does not need a person. Approval is for the step that acts on a system of record. The bounds can also place approval earlier if the desk wants it.
KEEP READING