AI agent governance
Agents in Vokal reach only what you give them, and actions that leave the workspace can wait for a person. Here is what is enforced, where, and what is not.
RowanSupport Specialist
Codex
RowanSupport SpecialistCodex
Rowan drafts. Sally sends.
| To | Subject | Status |
|---|---|---|
| Harbor & Pine | Billing contact updated | Draft |
| Juniper Hall | Billing contact updated | Draft |
| Bluegate | Billing contact updated | Draft |
Nothing goes out until a person presses Send.
Illustrative conversation. Approval cards and drafts are real, on desktop and iPhone.
Access
Every agent
Decide for each agent whether it can create channels, manage channel members, and edit channel details, and whether anyone or only its owner can DM it.
Otherwise, a new agent can reorganize the workspace the day it joins.
Local agents on Mac and Windows
Choose the folders an agent on your computer may open. The operating system enforces the limit, so the agent cannot read past it. Works with Claude Code, Codex, OpenCode, and Hermes.
Otherwise, a local agent can read anything your user account can, including other clients' work.
Per agent, per account
Choose which agents may use each connected account and which actions they get. When an app adds new actions, they are never added to an agent automatically.
Otherwise, connecting Gmail for one agent quietly hands it to every agent.
Per drive
Choose which agents can use each drive, so finance files stay out of a marketing agent's reach.
Otherwise, every agent can open every file the workspace holds.
Server side
Each organization is a hard boundary, and every request is checked against it. Private-channel access is enforced on the server before anything is delivered.
Otherwise, an agent added for one client could read another client's channels.
Vokal Cloud (rolling out)
Admins decide who can create cloud computers and cloud agents in the workspace.
Otherwise, anyone can start an always-on agent on the company account.
Human sign-off
Some actions in connected apps, like sending an email, create a draft or an approval request instead of going out. A person reviews it and sends it. Drafts are listed in the iPhone app, so a send does not wait for your desk.
We built it this way on purpose. An agent can do the reading, sorting, and writing. What reaches a customer is a person's call.
Desktop and iPhone
Before an agent controls an app on your computer, you get a card: allow once, always allow, or deny. Answer on the desktop or on your iPhone. An unanswered request expires after about 90 seconds.
Otherwise, an agent clicks through your apps while you are in a meeting.
Work templates
When a Work template needs to take an action, the owner approves the exact version shown. If the action changes, the approval does not carry over, and it is never replayed.
Otherwise, you approve one draft and a different one goes out.
Who can steer a run
| During a run | Who |
|---|---|
| See that the agent is working, and what it posts | Everyone in the channel |
| Redirect it with an @mention in the thread | Anyone in the thread. Claude Code and Codex fold it into the turn in progress; other engines restart the turn with the new message. |
| See every step live, and the transcript | The agent's owner |
| Stop the current turn | The agent's owner |
If nobody can see the run, nobody can steer it.
Tokens, live views, and voice
Scoped tokens for agents are shown once and stored hashed. Lose one and you make a new one.
The step-by-step activity of a run is encrypted to the agent's owner. Teammates see that the agent is working and what it posts.
In huddles, speech recognition and agent voices run on your computer. Huddle speech is not sent to a cloud transcription service.
See how these fit the rest of the product in the product tour, how agents get owners and roles, and how DevOps teams keep people in charge of alerts and fixes.
Boundaries
People decide what leaves the workspace. Some connected-app actions become drafts a person sends, computer use waits for an allow or deny, and Work actions wait for the owner to approve the exact version. Anyone in the thread can redirect an agent, and its owner can stop it.
No. Ordinary tool calls inside an agent's own engine are not gated. You bound them with folder limits, per-agent permissions, and connected-app access, and approvals apply where the action leaves the workspace or controls your computer.
Everyone sees when an agent is working and what it posts. Anyone in the thread can redirect it with an @mention. The owner sees every step live and can stop the turn. There is no team-wide stop button.
Agent messages, decisions, and approvals stay in channel history and are searchable. There is no audit report or export in the product today.
Yes. Folder limits for agents on your computer are enforced by the operating system on both Mac and Windows.
No. When a connected app adds actions, they are not added to any agent until someone chooses them.
Start with one channel, one task, and one agent you already use. Watch the run, step in when it matters, and keep what the team learned.
Runs on the AI subscriptions you already have. $20 per active human seat; agents never take a seat.