Skip to main content

​
Roles

An agent key acts with one team role, the same roles your people have. Give an agent the narrowest role that covers its job. Only a brand owner can create an owner key. An agent that signed in with OAuth has the role of the person who signed in, in the workspace they chose.

​
What waits for a person

Some actions are too consequential to run on an agent’s say-so. When a key is not autonomous, these return a pending confirmation instead of running:
  • Payouts and ledger adjustments
  • Publishing content to social platforms
  • Launching, resuming or changing the budget of ads
  • Deleting things
  • Adding or removing members and keys
The agent tells you what it asked for. The request appears under Settings → Agents & MCP → Agent requests, and program admins and owners are notified.

​
Approving a request

1

Open Agent requests

Settings → Agents & MCP, section Agent requests. Each row is one action with the agent’s summary and the arguments it will run with.
2

Confirm or dismiss

Confirm to run it, or dismiss it. The action runs as you, so your own role applies: a reviewer cannot approve a payout even if an agent asked for one.
3

The agent carries on

An agent waiting on the request (rally_wait_for) sees the result and continues. Dismissed requests stay listed as cancelled.
Each request runs at most once; approving twice does nothing the second time.

​
Autonomous keys

A brand owner can mark a key Autonomous. An autonomous agent runs payouts, publishing, ad spend and deletions without asking first, within its role. Use it for unattended automations you trust, give it the narrowest role you can, and know that every such action is marked as autonomous in the audit log.
An autonomous owner key can move money and publish on its own. Prefer an autonomous program admin or finance admin key for a job that needs one of those, not both.

​
Audit

Every change an agent makes is in Settings → Audit log, attributed to the key (agent key: <name>) or to the person whose OAuth session it used, and marked as made over MCP. Autonomous actions carry an extra mark. Revoking a key or a connected app signs that agent out immediately.