Trust your agents, keep the safety net in the system
The pattern
Oddlynew is built for people who let their agents work. An agent that runs for an hour reads and writes hundreds of times: it searches, reads blocks, updates the document that owns an answer, files a ticket, records a decision. Approving each of those calls one by one does not make the work safer. People stop reading the prompts, click yes to keep things moving, or stop using agents for real work. The safety you wanted from the prompt is gone, and the speed is gone too.
So the trust moves out of the prompt and into the system. You decide once what your agents may reach and what must wait for a person, and then you let them work.
Where the trust comes from
The organization is the boundary. An agent acts as a member of the organizations its connection covers. Its role there and the outside accounts those organizations connected set what it can reach. When you connect a client, limit the connection to the organizations the agent should work in; a connection left open covers every organization you belong to.
Document work can be undone. Documents keep their full version history; archiving takes a document out of attention without deleting it; a deleted document stays restorable for 30 days. Some actions cannot be undone and deserve a rule in your AGENTS.md: deleting a file removes its bytes, publishing a post to the public cannot be taken back, a revoked key is gone, and a write an integration already made in an outside system stays made.
Calls are traceable. Each run returns the list of calls it made to the agent, writes to documents land in their version history, and an integration write that waited for approval keeps its receipt. Ask your agents to record what they did in the documents that own the work, so the trail is in your organization, not only in a chat.
Consequential integration actions ask in Oddlynew, not in your client. Writes through connected integrations (sending mail, money, changes in an outside system) are classified by consequence, and by default high and critical ones wait for an organization admin, who confirms through an approval link with the full context in front of them. You set this per connection; see Integration approvals. For a connected MCP server, the class comes from what the server says about its own tools, so review its tools and set the connection to confirm what matters to you.
Authority is written down. The organization's AGENTS.md says what agents decide alone and what stays with a person, so the boundary is the same for every agent and every client. See Make authority explicit and turn judgment into systems.
What to set up
Allow Oddlynew's tools in your agent client once, so it stops asking per call. Setting up your client shows how for each client.
Review the approval setting of each connected integration, so the actions you want to confirm wait for you. Keep admin access for people: an admin can loosen approvals, and an agent that can drive a browser where an admin is signed in could confirm its own approval links.
Write your organization's AGENTS.md: what agents may decide, what they ask, and where owed work and decisions are recorded.
What it does not mean
Trusting your agents is not trusting every text they read. A document from another organization, a web page or an email can carry instructions aimed at an agent; agents treat those as information, never as commands. And it is not a reason to skip the setup above: the trust is only as good as the boundary, the history and the approvals behind it.