> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rallied.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Execute Mode

> Live AI execution with policy-based approval gates.

Execute Mode is the normal operating mode for production clients. The agent handles requests end-to-end: it diagnoses the issue, decides on a plan, and executes — pausing only when a tool's policy requires a technician (or manager) to approve first.

Every action is governed by the tool policies you configure in the dashboard. You decide which operations run automatically and which ones require a human sign-off.

## The approval flow

<Steps>
  <Step title="Employee submits a request">
    A request lands through one of your channels — a new ticket in ConnectWise, HaloPSA, or Autotask; a call to your Voice Agent number; or a message in Slack or Teams where you've connected one. For example: "I need access to Zendesk."
  </Step>

  <Step title="Agent diagnoses silently">
    The agent uses read-only tools to gather context — looking up the employee in Microsoft 365, checking what apps they already have access to, reviewing group memberships, reading your runbooks in Hudu or IT Glue, and so on. This happens in the background; the employee sees nothing yet.
  </Step>

  <Step title="Agent posts an internal note">
    The agent always posts an internal note on the source ticket (a ConnectWise note, HaloPSA action, Autotask note, and so on) with its full diagnosis and the plan it intends to execute. Your team can see this note; the employee cannot.
  </Step>

  <Step title="Agent checks tool policies">
    For each tool in the plan, the agent checks the policy you've configured:

    * **`auto`** — the tool runs immediately, no approval needed.
    * **`approval_needed`** — the agent must get technician approval before executing this tool.

    If every tool in the plan is `auto`, the agent executes the full plan and moves to the reply step. If any tool requires approval, the agent pauses and creates an approval request.
  </Step>

  <Step title="For auto tools: execute and reply">
    When all tools are `auto`, the agent executes the plan immediately and replies on the source ticket (or in the chat or call where the request came in) confirming what was done.
  </Step>

  <Step title="For approval_needed tools: request approval">
    The agent creates an approval request and notifies your technicians through the configured channel (see [Approval notification channels](#approval-notification-channels) below). The agent then waits — it does not reply to the employee yet.
  </Step>

  <Step title="Technician approves or denies">
    A technician with the `msp_technician` or `msp_admin` role reviews the plan and responds. If they approve, the agent proceeds. If they deny, the agent informs the employee that the request was not approved.
  </Step>

  <Step title="Agent executes and replies">
    After approval, the agent executes the approved plan and replies to the employee on the source ticket, call, or chat.
  </Step>
</Steps>

## Approval notification channels

When an approval request is created, your technicians are notified through the integration your MSP has configured. PSA channels (ConnectWise, HaloPSA, Autotask) are the primary approval channels; Jira and Slack are available where you've connected them.

| Integration | Notification method                    |
| ----------- | -------------------------------------- |
| ConnectWise | Note added to the ConnectWise ticket   |
| HaloPSA     | Action added to the HaloPSA ticket     |
| Autotask    | Note added to the Autotask ticket      |
| Jira        | Comment added to the Jira issue        |
| Slack       | Direct message to technicians in Slack |

Notifications go to all MSP users with the `msp_technician` or `msp_admin` role.

## Dual approval

Some operations require both a technician and a manager to approve before the agent can proceed. You configure this per tool on the integration's detail page by enabling the **Require manager approval** option alongside `approval_needed`.

When dual approval is required:

* A technician approval request is created (as always).
* A manager approval request is also created, linked to the technician request.
* **Both must approve** before the agent executes. If either party denies, the request is denied.
* The manager in question is the requesting employee's direct manager, resolved automatically by the agent from your identity provider.

<Info>
  Dual approval is configured per tool. For example, you might require only technician approval for adding a user to a standard app group, but require both technician and manager approval for resetting an admin account password.
</Info>

## How approval requests expire

Approval requests expire automatically after **24 hours** if no action is taken (this window is fixed, not configurable). When a request expires, the agent informs the employee that their request was not approved in time and they should resubmit if they still need help.

<Warning>
  An approved request can only be used once and is tied to the specific plan the agent submitted. If you approve a request, the agent executes exactly the plan that was presented — no more, no less.
</Warning>

## Tool policies

You configure tool policies on each integration's detail page (open it from the client's or MSP's **Integrations** tab). The available policies are:

| Policy            | What the agent does                                                                                  |
| ----------------- | ---------------------------------------------------------------------------------------------------- |
| `auto`            | Executes the tool immediately without requesting approval.                                           |
| `approval_needed` | Pauses and requests technician approval before executing. Optionally also requires manager approval. |
| `disabled`        | The tool is not available to the agent for this client.                                              |

## How to set Execute Mode for a client

1. Open the client's detail page in the dashboard.
2. On the **Overview** tab, find the **Operating Mode** section.
3. Click **Execute Mode**.

To make Execute Mode the default for all clients, open your MSP's detail page and click **Execute** in the **Operating Mode** section on the **Overview** tab. Any client set to **Inherit** will follow this default.

<Tip>
  Before switching a client from Plan Mode to Execute Mode, review the internal notes the agent posted during Plan Mode to confirm its judgment matches your expectations. See [Plan Mode](/agents/plan-mode) for guidance on the evaluation process.
</Tip>