> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runrally.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Approvals and roles

> Which agent actions wait for a person, how to approve them, what each role allows, and when to use an autonomous key.

## Roles

An agent key acts with one team role, the same roles your people have.

| Role | What the agent can do |
| - | - |
| Brand owner | Everything: programs, creators, content, money, settings, members and keys. |
| Program admin | Programs, creators, briefs, content and AI ads. No payouts, no members. |
| Content reviewer | Read everything about content and review it. No changes elsewhere. |
| Finance admin | Ledger, payouts, budgets and reports. |
| Support manager | Creator messages, support channels and notes. |

Give an agent the narrowest role that covers its job. Only a brand owner can create an owner key.

An agent that signed in with OAuth has the role of the person who signed in, in the workspace they chose.

## What waits for a person

Some actions are too consequential to run on an agent's say-so. When a key is not autonomous, these return a **pending confirmation** instead of running:

* Payouts and ledger adjustments
* Publishing content to social platforms
* Launching, resuming or changing the budget of ads
* Deleting things
* Adding or removing members and keys

The agent tells you what it asked for. The request appears under **Settings → Agents & MCP → Agent requests**, and program admins and owners are notified.

## Approving a request

<Steps>
  <Step title="Open Agent requests">
    **Settings → Agents & MCP**, section **Agent requests**. Each row is one action with the agent's summary and the arguments it will run with.
  </Step>

  <Step title="Confirm or dismiss">
    Confirm to run it, or dismiss it. The action runs as **you**, so your own role applies: a reviewer cannot approve a payout even if an agent asked for one.
  </Step>

  <Step title="The agent carries on">
    An agent waiting on the request (`rally_wait_for`) sees the result and continues. Dismissed requests stay listed as cancelled.
  </Step>
</Steps>

Each request runs at most once; approving twice does nothing the second time.

## Autonomous keys

A brand owner can mark a key **Autonomous**. An autonomous agent runs payouts, publishing, ad spend and deletions without asking first, within its role. Use it for unattended automations you trust, give it the narrowest role you can, and know that every such action is marked as autonomous in the audit log.

<Warning>
  An autonomous owner key can move money and publish on its own. Prefer an autonomous program admin or finance admin key for a job that needs one of those, not both.
</Warning>

## Audit

Every change an agent makes is in **Settings → Audit log**, attributed to the key (`agent key: <name>`) or to the person whose OAuth session it used, and marked as made over MCP. Autonomous actions carry an extra mark. Revoking a key or a connected app signs that agent out immediately.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.