The Inbox is where agent output becomes accountable human work. A recommendation is never just a chat response: it is stored with the source context, evidence, policy state, action draft, decision history, and execution outcome needed to review it later.
Open the Inbox
The view shows actionable items in active, blocked, or approved state. Use /open <row-or-id> to select an item.
For scripted use:
What to review
A work item can contain:
Use /recommendation, /evidence, /draft, /history, or /detail while an item is selected.
You can also ask a read-only question about the selected item. In interactive mode, type the question directly or use:
Questions use the same safe review context and do not perform actions.
Decisions
Available decisions depend on item state, policy, and your workspace role:
- Approve accepts the current draft.
- Edit and approve changes only paths allowed by the draft’s edit policy and requires a reason.
- Reject closes the proposal without execution and records a reason.
- Request rework sends the item back for another agent pass with feedback.
- Resolve closes work that does not need an action.
Warnings may require explicit acknowledgement before approval. Stale review versions are rejected so a decision cannot silently apply to a draft that changed after you opened it.
Execute separately
Approval and execution are separate steps. After approval, use:
or:
Mandala rechecks the agent lifecycle, capability grant, connector health, policy version, binding version, actor role, approval, and idempotency key at execution time. Replaying the same authorized request returns the existing outcome instead of duplicating work.
The executors included in the current repository are mock-only. They produce auditable simulated receipts and do not commit a live vendor or ERP change.
Role boundaries
Owners and admins can manage the workspace and make workflow decisions. Approvers can review, decide, issue execution capabilities, and run approved mock actions. Members can read and run workflows but cannot approve their own way around policy. Viewers are read-only. Agent principals receive no human-role permissions.