Spend approvals let a person say yes before an agent spends your credits. When an ask made by an agent breaks a rule you've set, such as costing more than £50.00, we hold it. The credits are set aside, nothing goes to heads, and the people you chose are asked. If one of them approves, the question goes live. If they deny it, or nobody decides in time, the credits go straight back to your balance.
Approvals are being rolled out to organizations gradually. If you don't see Approvals in the menu, they aren't on for your organization yet. Contact us if you'd like them.
Which asks wait
Policies apply to asks made by agents: an API key, a connected app, an AI assistant through MCP or a service account. People asking in the portal or the app are never held, and neither are asks to your own audience or asks funded by free credits.
Set a policy
Owners and admins open Approvals, then Policy at your approvals policy. Any one rule is enough to hold an ask:
- A single ask is over an amount, for example £50.00.
- Spend today would go over an amount (since midnight, UK time).
- Spend this month would go over an amount (since the 1st).
- Always ask a person.
- The ask uses a tier you pick, such as Tier 3.
- The ask has image questions.
Amounts include the full price of the ask. A policy can apply to the whole organization, one team, one project or one key. The narrowest one wins: key, then project, then team, then organization.
Who can approve
Choose roles (owners, admins and billing) and any named people. Nobody outside your organization or the team can approve. You can ask for one approval or two. With two, a second person has to agree before the question goes live.
Someone else must approve is on by default. It means the person whose key made the ask can't approve it, and they see "You can't approve this". You can turn it off if you accept that, and allow the key's owner to approve asks under an amount you set.
An approval waits 5 minutes to 24 hours, 1 hour by default. After that it's denied and the credits go back.
Approving in the app
An approval shows as a card marked Approval at the top of Answer, with a badge on the tab. Open it to see the question, the cost and how long it waits. Choose Approve or Deny, add a reason if you like, then confirm it's you with Face ID or your phone's passcode.
The check is fresh every time for an ask over £100.00. For smaller asks, a check you passed in the last 5 minutes still counts. Approving pays you nothing and doesn't count in your stats or tier. Heads never see it.
Approving on the web
Open Approvals in the portal, or follow the link in the email. We ask you to confirm it's you every time, with the way you signed in or a second step. Then choose Approve or Deny.
What the agent is told
Your reason goes to the agent and to the audit log. The agent sees your role, such as admin, but never your name.
- The agent's ask is accepted and waits: the API answers
202withapproval_required, and the question's status ispending_approval. The agent can poll the approval or wait on the question. - If it's denied, the agent gets
refused_by_policywith the reason and the approver's role. - If nobody decides in time, it gets
approval_expired. - If the agent withdraws the ask while it waits, the credits go back.
In the command line, 50heads ask exits with code 9 while an approval is pending. --wait-approval waits for the decision instead, and exits with code 1 if it's denied or expires.
How approvers are told
Approvers get a push in the app, batched so several approvals in one minute arrive as one. Quiet hours (21:00 to 08:00 by default) hold pushes back, and each person can change them under You, then Approvals. People without the app get an email, and a daily digest lists what's still waiting.
What's recorded
Your organization's audit log records each approval as it's requested, viewed, confirmed, decided or expired, with who, whether it was the app or the web, and the address it came from. A denied or expired approval is recorded as such, and the credits are shown back in your balance.