Agents API, Spaces, and Decisions: Wiring Approval Into the Loop

By Muhammad Kashif · Draft · AI automation & cybersecurity builder, Pakistan

OpenAI DevDay notes read like a control-plane catalogue: Dots with their own cloud computers and thousands of apps, Agents API shapes, Spaces, a Decisions API, Sign in with ChatGPT, Bedrock managed agents, MCP events, zero-retention private modes. I stopped collecting acronyms and started asking one question — where does approval live when something can act?

Dots and the always-on computer

Always-on agents with a cloud computer and a catalogue of apps are the product vision. I treat them like contractors with badges: useful on a scoped floor, dangerous with a master key. Sandbox first, allowlist apps, log everything, and keep a human who can revoke the badge without filing a ticket into the void.

GPT-6.1 Sol near-Astra at a fraction of the price is a routing gift if evals agree. Price without evals is how teams quietly downgrade quality while celebrating the bill.

Decisions API as a first-class gate

A Decisions API — Luna in the notes — is the shape I want even when I build it myself: the agent proposes, a policy or human decides, the action proceeds with an id. If approval is a Slack emoji with no audit trail, I do not call it a decision system.

I wire proposals to include blast radius, diffs, and a rollback hint. Approvers should not need archaeology to say yes.

Sign in with ChatGPT and identity sprawl

Sign in with ChatGPT across Notion, Vercel, Devin and friends reduces password friction and increases identity coupling. I ask who owns revocation when an employee leaves, and whether the agent's tokens die with the human session.

SSO convenience that outlives the human is a ghost with permissions. Ghosts do not belong in production.

Bedrock managed agents and shared responsibility

AWS-managed agents help with enterprise controls. They do not erase the need for my threat model. Shared responsibility means I still classify data, still scope IAM, still test failure modes when the managed layer hiccups.

MCP events are useful hooks for observability. I subscribe early so tool calls are not a black box sold as magic.

Private modes and retention promises

Zero-retention Private Intelligence modes matter for client workshops. I verify the mode per session, not per marketing page. Screenshots, exports, and "helpful" memory features can undermine a retention story if operators are sloppy.

I put a checklist beside the laptop: mode confirmed, connectors minimal, exports labelled, session ended deliberately.

Spaces as collaboration, not a junk drawer

Shared agent spaces drift into junk drawers unless someone owns taxonomy and retention. I appoint an owner, set expiry on experimental spaces, and ban production secrets from shared playgrounds.

If a Space cannot say why it exists in one sentence, it gets archived. Sentimentality is not a storage policy.

Wiring approval into my loop

Propose → decide → act → log → review. Skip decide and you have automation. Skip log and you have folklore. Skip review and you have debt. I implement the loop with whatever API names the week provides; the loop itself does not change.

Clients buy the loop. Vendor names are footnotes that get updated when DevDay happens again.

Pilot offer

One Dot-shaped agent, three apps on the allowlist, Decisions-style gate, weekly log review. Expand only after boredom — boredom means the scary parts got quiet for the right reasons.

Decisions without drama

I practice the propose/decide/act loop on low-stakes chores until it is muscle memory — calendar drafts, doc renames — so high-stakes Dots actions do not invent a new approval culture under pressure. Spaces that skip the loop get archived. Drama is usually a missing decide step.

Sign-in sprawl inventory

List every app that now offers Sign in with ChatGPT or similar. Mark which ones agents can also enter. Anything marked both gets a revoke drill. Sprawl without drills is how ghosts keep badges.

Private mode double-check

Before a client workshop I screenshot the retention mode indicator and drop it in the project channel. Memory is fallible under adrenaline. Screenshots are cheap. Zero-retention promises need receipts.

Dot badge revoke owner

Every always-on Dot-shaped agent has a human named as badge revoker on the project card. If that human is on leave, a deputy is named. Decisions API patterns do not help if nobody can pull the badge when Slack is on fire.