Most agents are models wired to tools: they do what they infer, and say “done” when the call returns. conxtagents acts only on approved playbooks, waits for approval on anything consequential until you let that action run on its own, checks the real system after every change, and records every decision.
The agent proposes what it learns from real work. Nothing crosses into the memory the agent acts on until you approve it, and rejected memory never governs anything.
Reads you marked as read-only run by themselves, and what they return is shown to the approver. An action can join them once the owner allows it and its record stays clean.
Anything that creates or blocks an account, changes a licence or touches a client’s books waits for your yes, with a signed, one-time approval.
Security-sensitive or novel cases go to a human. The agent stops instead of guessing.
A playbook waiting for review cannot drive an action. Only playbooks a person approved do.
Each approval issues a one-time token bound to a single user, team, playbook and action.
After every change the agent reads the system back. The receipt says what was approved, who or what approved it, and what the system showed afterwards.
Memory you decline is not just unused: it can never govern an action.