feat(automation): three AI lines per tool action — autonomous, AI drafts and a person sends, never touches — and a four-move automation setup #18430

Part of #18237. Design: Refined UI mockups AutomationSetup (new), ProcessCanvas, ProcessCanvasTable, Roles, Handbook (chapter "The three lines for AI"). Related: #17463 (three approval policies, one enforced), #18390.

Owner rule (2026-10-12)

AI has three lines, and they apply to every tool and procedure:

1. Autonomous: AI does it alone, then reports.
2. AI drafts, a person sends: a person reviews, edits and sends; it waits in Approvals.
3. AI never touches: only people act.

A line that is not set counts as line 2 until the owner role decides. Agents never change a line; changing one goes through Approvals.

Lines are set per action of a tool, not per tool. Example for a CRM connector and company email:

• read and draft: allowed
• send: needs approval
• delete: blocked

Setting up an automation is four moves

1. Connect: tools and connectors; credentials go to Company secrets.
2. Set the line: per tool action.
3. Give the job: plain-language job → a workflow of processes performed by a role.
4. Wire the trigger: web form, email received, schedule, webhook, work item status, file added to folder.

Owner example: when a lead comes in from the web form, check the address, add it to the CRM, draft a reply with a booking link, and write a one-page brief. Sending the reply waits for a person.

Acceptance criteria

• Every tool action, process and meta skill carries a line. A process's effective line is the strictest of its own line and the lines of the tool actions it uses, and the UI states why.
• Line 2 actions create an Approvals item and do nothing until a person approves; line 3 actions are refused for agents at the execution layer, not only hidden in the UI.
• Unset lines behave as line 2.
• Changing a line creates an approval request.
• Four-move setup flow:
  • If an action the job needs is blocked, Turn on is disabled with the reason.
  • "Send a test" shows every step and its line.
• One enforcement point shared with the existing approval policies (tech-debt(approvals): three approval policies, one enforced — needs_approval() and the 'minimal' guard profile have no production caller #17463), not a second policy system.

Needs a decision

• Strictest-wins makes a process that only reads through a tool inherit the tool's strictest action. Should the effective line come only from the actions the process actually uses? The mockup follows the per-action rule.

Generated by Claude Code