# Agent Control, Approvals, And Sandbox > Agent Control gives workspace owners one place to manage connections, enforce tool and sending limits, investigate redacted activity, approve exact high-impact plans, and use an isolated sandbox. - Human page: https://mailrith.com/docs/agent-approvals-and-sandbox - Markdown page: https://mailrith.com/docs/agent-approvals-and-sandbox.md - Category: AI Writing - Reading time: 13 min read - Last updated: 2026-07-22 - Related keywords: Agent Control, Approvals, And Sandbox, Agent Control, Approvals, And Sandbox documentation, AI Writing, AI Writing documentation, Mailrith documentation, Mailrith help, How Agent Approval Works, Open Agent Control, Check Beta Access, Review Agent Insights, Manage Agent Connections, Set Agent Policies, Investigate Agent Activity, Review And Approve, Deny Or Let A Plan Expire, Enable Agent Sandbox, Change Policy Or Reset, Resolve Agent Problems, Approval Safety Checklist, API Keys and Authorized Apps, AI Connections, Broadcasts ## AI Agent Notes - Use this article as step-by-step Mailrith product guidance, not as legal, financial, or deliverability advice unless the article says so. - Preserve exact Mailrith UI labels from the steps when explaining a workflow. - Prefer Mailrith's product term Subscribers when referring to people on an email list. ## What this guide covers Manage AI Agent connections and policies, review redacted activity, approve or deny high-impact work, and test safely in an isolated sandbox workspace. ## Sections - How Agent Approval Works - Open Agent Control - Check Beta Access - Review Agent Insights - Manage Agent Connections - Set Agent Policies - Investigate Agent Activity - Review And Approve - Deny Or Let A Plan Expire - Enable Agent Sandbox - Change Policy Or Reset - Resolve Agent Problems - Approval Safety Checklist ## Visual Reference ![Mailrith Agent Control Center showing connected agents, policy controls, approvals, and redacted activity.](https://mailrith.com/docs/screenshots/agent-control.png) Agent Control lets a workspace owner manage access and policies, inspect safe activity metadata, review exact effects before approval, and use an isolated synthetic-data sandbox. ## How Agent Approval Works Mailrith stops high-impact agent actions before they happen. The agent first creates a plan. Mailrith checks the current target, calculates a small preview, and shows the expected effects, affected Subscribers, warnings, blocking issues, and expiration. The action can run only after the workspace owner approves that exact plan. Live Broadcast sends, Automation or Sequence activation, bulk Subscriber changes or exports, webhook administration, and deletions always require approval. A workspace owner can require approval for more actions, but cannot turn off these required protections during beta. Approval does not give the agent general permission. Mailrith issues one short-lived token for the approved workspace, credential, operation, input, and target version. Changed, expired, reused, stale, revoked, or cross-workspace approval attempts are rejected. ## Check Beta Access 1. Use the workspace selector at the top of the left sidebar to choose the workspace the agent uses. 2. Under **Overview** in the left sidebar, click **Agent Control**. 3. Stay on the **Overview** tab and find **Beta Access And Safety**. 4. Check the status. **Production** means the enrolled workspace may request production actions. **Sandbox** permits sandbox work. **Suspended** blocks beta actions. **Not Enrolled** blocks high-impact production work. 5. Check **Sandbox Proof**. It must show **Verified** before an administrator can enable high-impact production access. 6. Check **Daily Actions** and **Daily High-Impact Actions**. These limits use the previous rolling 24 hours. 7. Check **Platform Mode**. **Controlled** allows operations that also pass their normal permissions and safety checks. Beta enrollment and limits are managed by Mailrith administrators. Ask Support to review your workspace when sandbox proof is verified but production access still shows **Not Enrolled**. Include the workspace name and sandbox action ID, but never include an approval token or API key. ## Open Agent Control 1. Sign in to Mailrith. 2. Use the workspace selector at the top of the left sidebar to choose the workspace the agent uses. 3. Under **Overview** in the left sidebar, click **Agent Control**. 4. Use **Overview**, **Insights**, **Connections**, **Policies**, **Approvals**, or **Activity** to open the control you need. Only the workspace owner can use Agent Control during beta. **Overview** shows connected clients, active credentials, pending approvals, current incidents, and recent actions. Click a recent action to open its Activity details. ## Review Agent Insights 1. Use the workspace selector at the top of the left sidebar to choose the workspace the agent uses. 2. Under **Overview** in the left sidebar, click **Agent Control**. 3. Click **Insights**. 4. Review **Reports In Progress** before asking an agent to create another long report. 5. Review **Completed Reports** to confirm that bounded results are available. 6. Review **Draft Recommendations**. A draft is advice only and cannot execute its proposed action. 7. Review **Running Experiments**. Phase 7 experiments can record an aggregate winner, but cannot change a campaign automatically. 8. Open **Activity** to investigate a related request. Open **Approvals** when a recommendation has created an action plan that needs an owner decision. Insights shows compact counts, not copied reports, message content, or Subscriber data. Agents retrieve report and diagnostic details through the bounded public API or MCP tools with the required workspace permissions. ## Manage Agent Connections 1. Open **Agent Control**, then click **Connections**. 2. Find the API key or OAuth client by its name, safe key preview, scopes, status, expiry, and last-used time. 3. Click **Revoke** beside one connection to stop it immediately. 4. Read the confirmation and click **Revoke Connection**. 5. For an urgent response, click **Emergency Revoke**. Confirm the selected active connection, then repeat if more affected connections need to be revoked. Revoked and expired connections remain visible so you can understand earlier activity. Revocation prevents new authenticated actions; it does not remove the compact activity trail. ## Set Agent Policies 1. Open **Agent Control**, then click **Policies**. 2. Under **Allowed Toolsets**, select only the kinds of work agents may perform. 3. Choose an **Approval Requirement**. Required high-impact protections cannot be turned off. 4. Set **Maximum Affected Subscribers** to limit one agent action. 5. Set the sending-window start and end as minutes after midnight. Mailrith shows the workspace time zone below the fields. 6. Select **Allow Agent Changes Only In Sandbox** if production workspace changes must remain blocked. 7. Click **Save Policy**. Mailrith enforces these limits before execution. The authenticated capabilities response also hides operations from disabled toolsets, so agents can adjust before attempting blocked work. ## Investigate Agent Activity 1. Open **Agent Control**, then click **Activity**. 2. Enter an exact **Request ID** or **Operation**, or choose an **Outcome** and **Risk**. 3. Click **Apply Filters**. Activity searches cover up to 30 days and return 25 rows at a time. 4. Click an activity row to review its request ID, action ID, operation, client, credential type, approver, retries, duration, failure code, result resource, and changed field names. 5. Click **Load Next Page** when more results are available. 6. Click **Export Current Page** to download only the current bounded page and filters. 7. To remove one terminal record, click **Delete Activity** and confirm. Pending actions and records under a legal hold cannot be deleted. Activity never contains authorization secrets, approval tokens, request bodies, email content, Subscriber names or email addresses, custom-field values, provider credentials, webhook secrets, or raw provider responses. Use **Clear Filters** to return to the recent seven-day view. ## Review And Approve An Agent Action 1. Use the workspace selector at the top of the left sidebar to choose the workspace the agent is using. 2. Click **Agent Control** under **Overview** in the left sidebar, then click **Approvals**. 3. In **Approval Queue**, click the action you want to review. 4. Check the operation, risk, expiration, requesting credential type, affected Subscribers, expected effects, warnings, blocking issues, and target IDs. 5. If the plan has a blocking issue, fix the issue and ask the agent to create a new plan. Blocked plans cannot be approved. 6. Click **Approve Action**. 7. Read the **Approve Agent Action** confirmation. Click **Approve Exact Action** only when the displayed effects match what you expect. 8. After approval, the requesting agent can claim one short-lived token and execute the unchanged action once. 9. If **Return To Agent** appears after the decision, click it to go back to the originating client. Mailrith never puts an approval token in this link. ## Deny Or Let A Plan Expire 1. Open **Agent Control** and select the action in **Approval Queue**. 2. Click **Deny**. 3. Read the confirmation, then click **Deny Action**. A denied or expired plan cannot be reused. The agent must create a new plan. Plans also become stale when the target changes after planning, even if a user already approved them. This prevents an old preview from authorizing a different current state. Mailrith also blocks an agent deletion preview when checking all related resources would exceed the safe preview limit. Use the displayed blocking issue to review the deletion directly in Mailrith or reduce the related resources before asking the agent to create another plan. An **Uncertain** result means execution may have started but Mailrith could not safely confirm the final outcome. Do not approve an automatic retry. Check the target and activity before deciding what to do next. ## Enable Agent Sandbox Agent Sandbox is available only for a new workspace with no existing resources and no email delivery connection. It creates a fixed, small set of synthetic Subscribers, a form, a segment, a Broadcast, form events, and engagement totals. The workspace displays a yellow **Agent Sandbox** notice on every page. 1. Create a new workspace and leave it empty. 2. Choose that workspace from the workspace selector. 3. Click **Agent Control** under **Overview**, then click **Policies**. 4. In **Allowed Test Recipients**, enter up to 20 email addresses, one per line. These addresses identify controlled test recipients. Campaign delivery remains simulated. 5. Click **Enable Agent Sandbox**. 6. Wait for the **Agent Sandbox** notice and synthetic data totals to appear. Sandbox Broadcast sends and workflow activations are simulated. They do not enter ordinary provider or delivery queues. External webhook actions are blocked, and an ordinary email delivery connection cannot be added to a sandbox workspace. ## Change Policy Or Reset The Sandbox 1. Open **Agent Control** for the sandbox workspace, then click **Policies**. 2. Choose **Required High-Impact Actions**, **All External Effects**, or **Every Change** under **Approval Policy**. 3. Edit **Allowed Test Recipients** if needed, then click **Save Settings**. 4. To replace the seeded data, click **Reset Synthetic Data**. 5. Read the reset confirmation. Mailrith removes only resources recorded in the current seed manifest. Resources you created are not removed. 6. Click **Reset Synthetic Data** in the confirmation dialog. ## Approval Safety Checklist - Approve only the operation and targets you expected the agent to use. - Read warnings and affected Subscriber counts before approving a live send or bulk change. - Do not copy or ask an agent to display approval tokens. - Deny an action when the request is surprising, unclear, stale, or larger than expected. - Revoke the API key or Authorized App if the requesting integration should no longer have workspace access. - Use Agent Sandbox before enabling a new integration to perform high-impact production work. ## Resolve Agent Problems ### Fix A Connection Failure 1. Open **Agent Control**, then click **Connections**. 2. Find the connection and check its status, Permissions, expiration, and last-used time. 3. If it is expired or revoked, reconnect the Authorized App or create a new task-specific API key in **Settings** → **API Keys**. 4. If OAuth returns to an unexpected address, stop and contact Support. Do not approve it or paste the failed URL into a public message. ### Fix A Denied Permission Or Stale Approval 1. For a denied Permission, open **Agent Control** → **Connections** and confirm the connection has the smallest task preset that includes the operation. 2. Open **Agent Control** → **Policies** and confirm its Toolset is selected and the action stays within workspace limits. 3. For a stale action, open **Agent Control** → **Approvals**, select the old action, and click **Deny**. 4. Refresh the changed resource, then ask the same connection to create a new plan. Never reuse the old approval. ### Investigate An Uncertain Outcome 1. Stop the agent from retrying the operation. 2. Open **Agent Control** → **Activity**. Enter the exact **Request ID**, or click **More Exact Filters** and enter the **Action ID**. Click **Apply Filters**. 3. Open the result and check its target, result resource, attempts, and stable failure code. 4. For a Broadcast, open **Campaigns** → **Broadcasts**, select the Broadcast, and check its progress before taking another action. 5. Contact Support when Mailrith and provider evidence do not show one clear final outcome. Share only the workspace name, action or request ID, time, and client version. ## Related Guides - [API Keys and Authorized Apps](https://mailrith.com/docs/api-keys-and-authorized-apps.md): API keys and authorized apps control how outside systems access a workspace. This guide explains when to use each credential type, how to create credentials safely, and when to revoke access. - [AI Connections](https://mailrith.com/docs/ai-connections.md): AI connections let Mailrith draft content with your own provider account. This guide explains providers, API key and OAuth setup, workspace assignments, default models, connection statuses, and repair flows. - [Broadcasts](https://mailrith.com/docs/broadcasts.md): Use broadcasts for newsletters, product launches, announcements, and any message you send once to selected subscribers. Compose, target, test, and send or schedule the campaign in one workflow.