Every RoleAxis agent in your workspace works at one of three levels, set agent by agent by your workspace admin. The level decides one thing: what happens between the moment an agent finds something and the moment your system changes. This page explains each level as the code enforces it on the date above, then what is always asked of a person whatever the level, and what is never done at any level.
Reports only
The agent reads your connected records, runs its checks and records each finding with the records behind it: the bill, the order, the receipt, the amounts. A person reads the finding and decides what to do in your own system. Approving a finding at this level writes nothing anywhere.
Some agents are built to report and nothing more. An agent like that is held at this level whatever the workspace policy says, so a setting cannot give it a power it was not built to have.
Drafts and waits
This is the default for an agent that can write. The agent prepares the exact change it recommends, with its reason and the records behind it: a hold on a bill, a supplier query or a payment reminder added as a to-do on the record, a draft vendor bill from an invoice you uploaded, a stock transfer or a draft purchase order. The draft waits in the approval queue.
- Only a person signed in with their own account can approve or reject it. The shared workspace key can read, not decide.
- On approval, RoleAxis re-reads the records, writes the change to your system through the connector, and logs who approved it. An approved change is written once; a second attempt is refused.
- A rejection carries a note when your policy asks for one, which it does by default.
- RoleAxis sends no email itself. An approved reminder or query becomes a to-do in your ERP, and a person sends it.
Alone under a limit
This level is off by default, for every agent. It lets an agent carry a few routine actions without a person, inside a limit your admin signs. To switch it on for an agent, all of these must hold:
- a workspace admin, signed in with their own account, makes the change;
- the agent is available and has passed its go-live check in your workspace, and it is not paused;
- your workspace is active or on its evaluation;
- the admin chooses which action types it covers, from a short list, and signs a limit per action: 500 in your workspace's currency by default, never more than 2,000, and never above your policy threshold.
The admin's signature, with the limit, the action types and the policy version, is recorded in the audit log. Changing the limit or the list makes the signature stale, and nothing runs alone until a new one is signed.
The action types that can be put on the list are holds on duplicate bills and on VAT and three-way mismatches, supplier queries, draft bills from matched invoices, first and second payment reminders, to-dos and flags, stock transfers and small reorders as draft purchase orders. A new workspace starts with payment reminders, stock transfers and purchase orders; the others are switched on one by one.
Even then, an action runs alone only when, at that moment:
- its type is on the list the admin signed;
- its amount is known, in your workspace's currency, and within the signed limit. An amount in another currency, or one that cannot be read, waits for a person;
- it is not a material or high-value draft, and nothing has marked it for review;
- the agent has not used up its daily cap of actions.
If any of these fails, the draft waits for a person, as under Drafts and waits. An action carried alone goes through the same checks and the same writer as an approved one, and is logged as Executed within limits, with the limit it ran under. A signed-in admin or manager can record a reversal of it, with a note.
What is always asked of a person
Whatever level an agent is set to, these still go to people:
- Material drafts. A draft from 5,000 to 20,000 in your workspace's currency by default, or one across several lines or locations, needs two different signed-in approvers. It never runs alone.
- High-value drafts. At or above 20,000 in your workspace's currency by default, a draft is decided in the RoleAxis owner console by two different RoleAxis approvers, not from your workspace.
- Judgement calls. A payment hold on a supplier whose details changed, a proposed payment run, an escalation to a customer, a supplier switch, a dispute, a credit note or a write-off, and any change to master data are never carried alone.
- Pausing. Pause or resume any agent from your dashboard. A paused agent starts no new runs, and its drafts cannot be approved until you resume it.
What is never done, at any level
Some actions have no level at all. Tax rates, tax filings, submissions to a tax authority, bank or IBAN details (a supplier's or an employee's), payroll payments, salary changes, closed periods and the chart of accounts are refused by the code before a draft exists, for every agent and every caller. There is nothing to approve because nothing is created. The full list, and how it is enforced, is in What RoleAxis's agents will never do.
Who can change the level
A workspace admin sets the level for each agent from the dashboard. Every change to the workspace policy is logged with who made it, when, and the policy before and after. The approval history, including every rejection and every reversal, stays in the workspace's hash-chained log.