Autonomy
Choose what Estelle may do without a review click, from read-only help to pull requests, branch writes and explicitly granted actions.
View as MarkdownAutonomy is the ceiling on actions Estelle may take in your repositories and connected apps. Read only is the shipped default. Raise it only when a workflow needs the next level, and use the narrowest level that works.
Open Settings → Sessions & agent → Autonomy to see your current level. On a team, only an admin can change it, and each member's agents run under that member's own ceiling.
#Choose a level
| Level | Choose it when | What changes |
|---|---|---|
| Read only | You want answers, retrieval and advice without repository writes. | Estelle writes nothing. This is the default. |
| Propose | You want completed work delivered for review. | Estelle can commit and push its own branch and open a reviewable pull request. A person still merges it. This is the recommended setting for coding work. |
| Branch | Your workflow expects direct updates to a working branch and CI there. | Estelle can push to a non-main working branch and run CI. You must acknowledge the risk. |
| Execute | A specific task needs the highest available permissions. | Estelle can merge and take destructive actions in connected apps only when explicitly granted for that task. You must acknowledge the risk. Protected areas still require a person. |
Every level below Execute ends at a pull request a person merges. Raising the ceiling does not enable automatic deployment at any level.
Read the current setting
Open Settings → Sessions & agent → Autonomy and compare the level with the work you actually need.
Select the new level
Choose Read only, Propose, Branch or Execute. For Branch or Execute, read the confirmation and select I accept the risk only if you accept direct actions without a review click.
Check the result
The selected radio button shows the saved ceiling. If the change is refused, the page explains why and keeps the previous setting.
#Allow verified fixes to merge
Auto-merge verified fixes is separate from the autonomy level and is off by default. Use it only when you are comfortable letting an eligible fix merge without your review click.
- In Autonomy, turn on Auto-merge verified fixes.
- Read the confirmation, then choose Turn on auto-merge.
- Leave the switch off if every change should wait for a person.
When enabled, only a fix that passes all required verification can merge. A fix that does not qualify stays a reviewable pull request instead. Passing verification is strong evidence, not a guarantee that the change is correct.
Changes to auth, billing, schema, security or deploy always require a person, even with auto-merge enabled. If auto-merge is unavailable, the switch explains why.
You can turn your own auto-merge off at any time with the same switch.
#How automations differ
An automation can have a narrower effective ceiling than your account setting:
- Runs started by an outside event, such as a pull request, push, Slack message or webhook, are read-only. They report results and cannot comment, push, merge or deploy.
- Scheduled runs report and do not merge or deploy.
- A template that delivers a change needs Propose or higher. Below that, the run can still report, but its delivery step is refused with the reason.
Read the individual run receipt to see what completed and whether a delivery step was refused.
#Review autonomous activity
Open Settings → Activity to inspect agent runs, requests and the audit history. Use it to confirm what acted, what changed and whether a pull request needs your attention.