Who authorizes an outbound action?
A person, at one of two moments — before a task starts, or before an individual call or message goes out. A multi-day task is created first and does nothing until someone confirms it; that confirmation is the authorization for the work inside the limits it was given. A standalone call or email is queued as the exact thing the assistant wants to do and waits.
Approval away from a screen uses an 8-digit code that a signed-in person reads on the dashboard, or in the approval email Yawp sends to your workspace's notification addresses when a task asks you to decide something. The model never sees it, so a confused — or manipulated — assistant cannot approve its own work. What gets approved is transmitted byte for byte, with no model call in between. The first message to any new counterparty is always held this way, even inside a task already confirmed.
An email asking for your approval can also carry one-tap links. A link opens a page that shows exactly what would go out and does nothing until you press its button, so a mail scanner that opens it changes nothing. Each link works once, for one draft and one action, only for the address it was mailed to (and, if that address is a member's, only while they are still a member), and stops working when the draft changes or the request expires (24 hours for a draft). A link can approve only a plain first message the task already allows, on a task that is not allowed to spend money and was given none of the details you release for one task: one that names no amount, uses none of the words that agree to, pay for, renew or cancel something, shares no phone number or other email address, and goes to someone who has not replied yet. That is a word check: it errs toward asking you to sign in, but it cannot read intent, so what bounds a link is that it can only send an opening, on a task with no power to spend, from your own approval email. Anything else (an answer to someone, money, your details, a call) still needs you signed in. Declining, or asking for a change, works from any link, and a change never sends anything by itself: after one, every email and call on that task waits for your approval, and no link can approve any of it, until you approve one drafted after the change yourself, signed in or with the code. Yawp stores links only as one-way hashes; the email itself, and your mail provider's copy of it, carries the live link until it expires. A reply to the email never approves anything. The accepted risk, stated plainly: whoever holds the email holds its links, so treat an approval email like the code it carries.
Two things are not gated per action, and you should know both before you decide this is enough. An assistant can be set to trust mode for calls, in which case it dials without waiting for you — the authorization is the setting, made once, not the call, and only a signed-in person can make it: an API key cannot turn trust mode on or raise a daily call limit. Every workspace also has a daily cap on calls across all its assistants and a limit on calls at once, lower for a new workspace. And a workspace can turn on email autopilot for tasks, which lets later replies to a counterparty you already approved go out without a second approval, up to the spending ceiling that task carries; anything above the ceiling comes back to a human. Both are off by default, and both are workspace settings rather than something the assistant can grant itself.
Connector clients that can render a form may offer approve and deny inline instead of a code — a form only you can click. That is an explicit per-key opt-in, off by default, so a stolen key cannot be the proof a human decided.