## Overview

**Autonomy** defines how much the **Bot** (Maestro acting inside the conversation) does on its own
versus when it asks a person to confirm. You pick the level of trust, and it governs how the Bot
behaves in support.

There are **three modes**:

- **Autopilot** — the Bot executes on its own, without waiting for approval.
- **Copilot** — the Bot **proposes** cards (a message draft or a module action); you **review and
  send**. Nothing goes out on its own.
- **Hybrid (Require approval / HITL)** — the Bot acts on its own in day-to-day work, **except** for
  **sensitive actions**, which are **held, waiting for your approval**.

The safety principle is simple: in **Hybrid**, nothing sensitive or final happens without approval;
in **Copilot**, nothing is sent without you. You decide how much to trust.

> This concept has analogs elsewhere in the platform: the Brain's **departments** have their own
> autonomy level (including an "Ask first" tier), and **Follow-ups** have AI-draft approval. Both are
> linked under "See also".

## Prerequisites

- **Maestro enabled** and a Bot/agent configured on the inbox.
- **Administrator** permission to set the autonomy mode.
- An account **administrator** to approve: the approval notification, the shield and the queue reach
  administrators only. The conversation's assignee (or, failing that, its team) is @mentioned in the
  private note.
- The **per-module tools** you want proposed/parked must be **enabled** — see the tools article.

## Step by step

1. In the Bot configuration, choose the **autonomy mode**: Autopilot, Copilot or Hybrid (Require
   approval).
2. To change only one conversation, open the **Maestro** side panel, click the **Autonomy mode** card
   and choose another mode. The card says **Set for this conversation**; use **Use Bot default** to
   remove the exception. Only administrators can make this change.
3. In **Copilot**: the Bot proposes cards (a draft or a module action); you review and send/confirm —
   nothing goes out on its own (details in the generative copilot article).
4. In **Hybrid**: for day-to-day actions the Bot acts; when a **sensitive action** comes up, it is
   **parked** — the Bot posts a **private note** that **@mentions the conversation's assignee** or,
   failing that, its team (the mention fires the native notification) and creates an **approval
   card** with an action id.
5. An account **administrator** taps/clicks the **Maestro** indicator in the conversation header to open the panel; the
   adjacent shortcuts **Pause**, **Resume**, or **Take over** the service. Pending approvals stay
   visible in the numbered shield. In the panel, choose **Approve** or **Reject**. On
   **Approve**, the **exact action** that was held is re-executed; the note records **who approved it**.
   Only account **administrators** see the numbered shield and the approval queue, and only they
   can **Approve** or **Reject**. Other agents see the private note in the conversation, but not
   the queue.
6. In **Autopilot**: the Bot executes on its own (sensitive actions are still recorded in the audit
   trail).
7. Track the result on the **card** and in the conversation's **activity line**.

## Settings & options

### Private notes and human support

A private note neither pauses nor resumes the Robot. Use notes for internal communication without
changing who serves the contact. If the Robot was already paused, the note preserves that pause.
A public reply sent by a person, an explicit human assignment or **Take over** still triggers a
pause according to the agent settings. Use **Resume** to return the conversation to the Robot.

### The three autonomy modes

| Mode | Behavior |
|------|----------|
| **Autopilot** | Runs on its own; no approval wait. |
| **Copilot** | Proposes; the person reviews and sends. Nothing is sent without you. |
| **Hybrid (Require approval / HITL)** | Runs on its own, **except** sensitive actions, which are parked for approval. |

### What counts as a sensitive action in Hybrid (gets parked)

- **Assign to a team**, **run a macro**, **mark the conversation as resolved**.
- Writes to **CRM**, **Tasks**, **Calendar** (create/edit/reschedule/cancel an appointment) and
  **Payments**.
- **Commerce recovery** (a recovery card sent to the customer), **cancel** a follow-up cadence,
  **enroll into a distribution group** and **trigger a collaboration round**.
- **Database** writes, **generate video**, **contracts** (create/send/remind) and **delegating to a
  sub-agent** when that delegation is marked as sensitive.

### What the Bot does freely (even in Hybrid)

- **Reply** to the contact, add **labels**, **internal notes**, **reactions**, **generate an image**,
  **knowledge-base searches** and other **read-only** lookups.

### Updates to the contact record

When updating a name, email, tax identity or address, the Bot checks the fields returned by the API.
A response that does not confirm the change is not reported as a completed update. The write may
have been saved: inspect the contact before trying again. A hidden or masked address is not treated
as empty for a partial update.

When only the document mask is visible, confirmation is limited to the mask and type; hidden digits
were not checked. A temporary lookup failure also does not mean that the contact does not exist.
Field permissions and Hybrid approval still apply.

### Contracts sent by the Robot

Sending a contract for signature is a sensitive action: in Hybrid mode it is parked for approval. In
Autonomous mode, what the Robot may do is decided by the account in
**Contracts > Settings > AI agent**, with both options off by default:

- **The AI agent can send contracts for signature**: off, the Robot does not send and reports that a
  person must send. On, it sends only to the contact of the conversation it is handling.
- **The AI agent can sign for the company automatically**: off, a contract sent by the Robot waits for
  a person to click **Sign for the company** on the contract page. On, the AI agent signs legally
  binding documents on behalf of the company, with no person reviewing them.

If automatic company signing is disabled before the signature occurs, the sent contract waits for
the company; signatures already applied remain valid. An action a person approves in Hybrid mode
runs with that person's permissions and follows the human send rule. If the Message is recorded in
the conversation but its publication is pending, the result reports `publication_pending`: check the
delivery before retrying and retain the same attempt key.

The **Send contract for signature** tool must also be enabled in the Robot's tools. Enabling it there
does not replace the Contracts options: the platform checks both on every send.

### Human-only action

- **Approving an AI Follow-up draft** is always human — the Bot **never approves its own draft**. This
  holds in any mode (see the Follow-ups article).

### The approval card and note

- The **private note** @mentions the conversation's assignee (or, failing that, its team) and
  references the **action id**; the mention triggers the platform's native notification for whoever
  was mentioned.
- The **approval card** sits in the conversation's **Maestro panel**, with **Approve** and **Reject**,
  and is shown to account **administrators** only.
- The decision is **recorded** with **who approved** — and on approval, the exact parked action is
  re-executed.

### An approved macro runs with the approver's permissions

- When the Bot parks **run a macro** and an administrator approves it, the macro runs **as the
  approver**: with that person's permissions, conversation access and identity, not the Maestro
  technical user's. Messages the macro sends come from the approver, and an assign-to-self action
  assigns that person.
- Before approving, the platform checks that you can run that macro on that conversation. If you
  can't (for example, someone else's personal macro, or one published to another audience), the
  approval is refused with the reason, **nothing runs**, and the action stays pending for someone who
  is allowed, or to be rejected.
- Permission is checked again when the macro runs: if it is removed between approval and execution,
  the macro does not run.
- When the Bot runs a macro on its own, in **Autopilot**, it still uses the Maestro technical user.
- **Flow Builder human approval:** a flow that uses the **Human approval** step to approve a Bot's
  parked action no longer approves a macro. The step ends with a failure and the macro stays pending,
  without running, because it must run with a person's permissions and the flow has none. To migrate,
  leave the macro for an administrator to approve or reject in the Maestro panel and adjust the flow to
  handle that step's failure (for example, by notifying the team), without repeating the same approval
  automatically. Other actions can still be approved by the flow.

### Handoff to a human: status, priority and summary

When handing a conversation off to a human team, the Bot sets the conversation's **status** (open,
pending, snoozed or resolved) and **priority** (none, low, medium, high or urgent). Each one can be a
**fixed** value or **"Maestro decides"**: in that mode the Bot itself picks the most suitable value per
conversation, at the moment of handoff — a fixed value always prevails over the Bot's choice. The
**handoff note** sent to the agent includes the **reason** and a **conversation summary** (generated on
the spot when there is no accumulated summary yet), so the person can take over with context.

### Taken over by a human (the bot stands down, then comes back)

When a person **replies** in the conversation (from the dashboard or the mobile app) or **pauses** the
bot, it **stands down on that conversation** — it stops replying so it does not talk over the human.
This applies to that conversation only; the bot keeps working everywhere else.

Two options control the comeback:

| Option | What it does | Default |
|---|---|---|
| **Resume automatically after a while** | The bot takes the conversation back once the window below passes with no new human reply. | On |
| **Resume after** | The idle window before it returns: 1 hour, 4 hours, 12 hours, 24 hours, 48 hours, 1 week, or **Custom** (you type the hours). | 24 hours |

- With **auto-resume off**, the bot stays paused on that conversation **until a person hands it back**
  — there is no time-based return.
- The clock runs from the **last human message**: if the person replies again, the window restarts.
- The minimum accepted window is **1 minute**; anything shorter is raised to that floor.
- The setting is **per bot** (it applies to every inbox the bot answers on).

### Where the mode applies, and the per-department analog

- The mode configured on the Bot is the default for every inbox it serves. A conversation may keep a
  persistent exception; precedence is **conversation → Bot**. The change starts on the next turn,
  does not interrupt an in-progress reply, and neither executes nor discards existing approvals.
- The Brain's **departments** have **their own autonomy level** (including "Ask first") — a separate
  setting, detailed in the departments article.

## Use cases

- **A team new to AI**: start on **Copilot** and review everything before sending.
- **A trusted operation with guardrails**: **Hybrid** — routine replies on their own, money/data moves
  waiting for approval.
- **High volume, low risk**: **Autopilot** for simple touches, or **Hybrid** for most cases.
- **Sensitive sub-agent delegation** kept under approval in **Hybrid**.

## Tips, limits & best practices

- Approval requests describe the action in plain language and show team or person names when they can be confirmed within the account. If a name is unavailable, verify the destination before deciding; a numeric reference does not confirm identity.
- If the queue does not load, use **Try again**. A loading error does not mean there are no pending requests.

- **Grow trust** gradually: Copilot → Hybrid → Autopilot.
- Make sure an **administrator** watches the approvals: only administrators receive the approval
  notification and can decide. The assignee (or the team) is only @mentioned in the private note.
- **Review pending items** often so the flow doesn't pile up.
- **Approving re-executes the exact parked action** — check the data before approving; if something
  changed, **reject** and ask again.
- Only **enabled** tools are proposed; keep the more powerful ones starting with **approval**.

### Resume after a handoff

After **Resume** is confirmed in the conversation, the Bot takes over again and the previous handoff marker is cleared. If a flow still has priority, the Bot waits for its release. The latest pending message can be handed back within the one-hour limit; a newer message supersedes the older one. A failed or pending confirmation does not automatically release the conversation.

Synchronization also recognizes an explicit Resume confirmed through the API, while preserving a more recent human handoff. If an older conversation appears active but remains blocked by its previous handoff, confirm **Resume** again. A timer-based activation does not remove that marker by itself.

## Troubleshooting

- **"I can't approve a macro"**: the macro runs with **your** permissions. Check that you can run it
  (personal and selective macros have a restricted audience) and that you can access the
  conversation. Someone who is allowed can approve it, or you can reject the action.
- **"My flow stopped approving a macro"**: the Flow Builder **Human approval** step does not approve
  macros, because they run with the approver's permissions. Approve or reject the macro in the Maestro
  panel and adjust the flow to handle the step's failure, without repeating it automatically.
- **"The action didn't run"**: in Hybrid, a sensitive action is held — an **administrator** has to
  **approve it in the Maestro panel**.
- **"Nobody saw the approval request"**: the approval notification goes to the account's
  **administrators** — check their **notifications**. The private note @mentions the conversation's
  assignee or, failing that, its team.
- **"The approvals queue shows an error instead of the list"**: Maestro could not read the queue at
  that moment. Nothing was approved, rejected or removed, and approvals may still be waiting — that
  is why the queue is not shown as empty. Use **Try again** in a moment; meanwhile, the private notes
  in the conversations still show what is on hold.
- **"The Bot acted on its own on something I wanted to review"**: it's **not on the sensitive list**,
  or the mode is **Autopilot** — switch to **Hybrid**.
- **"I can't approve an AI Follow-up draft through the Bot"**: draft approval is **human by design** —
  see the Follow-ups article.
- **"Approve doesn't work and the card says Maestro is paused"**: after a handoff to a human, or when
  someone pauses or takes over the conversation, the Bot stands down in that conversation and no
  approval can run there. Nothing was run. If the action is no longer needed (for example, the
  transfer already happened), **reject** the proposal. If it still is, resume Maestro in the
  conversation, then approve. A **team transfer** proposal is closed on its own when the Bot itself
  already handed the conversation off: it leaves the panel, and a click on an outdated screen says it
  was superseded by the handoff the agent made, without running anything.

### Review an approval

Text follows the interface language without changing registered names or execution parameters.

After you **approve** or **reject**, the interface confirms, in the language you use it in, when the decision was applied. When it was not applied, it explains what happened to the attempt: nothing ran and the proposal is still pending (resolve the cause, for example by resuming Maestro, and approve again); nothing ran and this proposal can no longer run (reject it and ask for a new action); the proposal is no longer pending and nothing on record says why, so it may have been approved in another tab (check the conversation history before asking for a new action); the attempt was used with no effect (it will not run again; ask for a new action); or the result was not confirmed (check the conversation before any new action and do not approve again).

Decision buttons are unavailable during refresh or execution. A queue loading failure offers **Try again**, which does not approve anything. When delivery needs verification, check the outcome before proposing another action; do not repeat a transfer just because confirmation was delayed.

## See also

- [What Maestro AI and the Account Brain are](/hc/ajuda/articles/maestro-brain-overview-en)
- [Generative copilot: propose, confirm and execute](/hc/ajuda/articles/maestro-brain-copiloto-generativo-en)
- [Departments, risk analysis and insights](/hc/ajuda/articles/maestro-brain-departamentos-risco-insights-en)
- [Maestro tools by module](/hc/ajuda/articles/maestro-brain-ferramentas-maestro-por-modulo-en)
- [AI with human approval (human-in-the-loop) in Follow-ups](/hc/ajuda/articles/follow-ups-ia-com-aprovacao-humana-en)