Trust · Action classes

Every action is read, reversible or sensitive

The class of an action decides what must happen before it runs. The class is set in code when the tool is defined, not by the model.

The three classes

01

Read

Runs automatically, inside the scopes you granted. Searching mail, reading a calendar, querying the CRM. Nothing changes.

02

Reversible write

Runs only where a workspace admin switched that category and scope on. Off by default. Examples: create a task, log a note, move a deal stage.

03

Sensitive

Always waits for a person. No setting turns this off. Examples: sending external email, deleting, publishing, deploying to production.

What always counts as sensitive

External email: Sending to anyone outside the workspace
Deletes: Removing records, files or messages
Money: Payments, refunds and transfers
Ad budgets: Changing spend on any ad account
Publishing: Putting content live
Production deploys: Releasing code to production
Contracts: Creating or sending agreements
Permissions: Changing who can do what

Approvals are tied to the exact action

When a sensitive action needs a person, the approval covers a hash of the exact payload. If a single word in the email changes, the old approval no longer matches and Brigham.ai asks again.

In-app approval, plus a notification
Links in notification emails open a confirm page and act only on a click, because mail scanners open every link
Every decision is audited

Starts read-only

Each connection starts read-only. Write access is a separate, explicit grant. Brigham.ai drafts into your Gmail Drafts folder, and sending is available too: every message waits for a person’s approval before it goes.