In a SalexHub organization, people aren't the only ones who make changes. The Agent works for you, workflows run on their own, and since the API opened in October 2026, your own code does too. They all act through one registry of 523 tools, and every call they make meets your approval rules before it runs. This post explains how that works and which checks apply to whom, and it names the settings that don't go through the registry yet.
One set of tools#
The registry has one tool for each thing that can be done in an organization, such as creating a record, updating a deal, turning a quote into an invoice or sending an email. The Agent, workflows and API keys use the same tools, and most of the app's own screens do too.
Before a call runs, it's checked in the same place:
- Approval rules apply to people, the Agent, workflows and API keys alike. Say invoices above a set amount need a manager's approval. The rule holds the invoice whether a person, a workflow or the Agent started it.
- Your role limits the Agent, API keys and people. The Agent works with your permissions, and a key acts with the weaker of two roles, its own and its creator's. A workflow runs as itself, so no role applies to it, but its steps still meet your approval rules.
- A budget of steps and AI credits limits the Agent and workflows. One answer from the Agent can take up to 12 steps.
Every tool has a class#
Each tool has a class for the kind of change it makes, and the Agent's autonomy mode decides which classes can run without asking:
| Tools | Class | Runs without asking |
|---|---|---|
| 96 | Reads | In every mode |
| 71 | Writes | From Auto inside the organization, except values for Propose properties |
| 2 | Sends | From Auto including replies |
| 139 | Structure and steps | Only in Full autonomy |
| 44 | Access, packs and privacy | Never. A card in every mode |
| 38 | People only | Never. No agent runs them |
The last row matters most. No agent can erase a person's data, change someone's role or decide an approval, in any mode and even with your approval. An API key can't either: a key calls only the tools that need no approval.
What doesn't go through it yet#
A few settings still save directly instead of through the registry: the organization's profile, AI settings and your own account.
This site first said that every change in SalexHub went through the registry, and later named dashboards and reports as exceptions. Both were wrong: dashboards and reports have saved through the registry since August 2026. The pages now name the settings.
What developers can use today#
- Available now: the REST API, with one operation per tool, and the MCP server for agents that speak it, both at
app.salexhub.com/api/v1with a key you create in Settings; signed webhooks when records change; read-only embeds of records you choose to publish; a form endpoint; a cookie-free tracking script; and a bridge for messenger conversations. - Not yet: the TypeScript SDK is generated from the same contract and is not published, and an external agent still authenticates with a key rather than by signing in with OAuth.
When this post was written, in September 2026, the API and the MCP server were built and hosted nowhere; both opened on 7 October 2026, and this section was rewritten the day after.
Build on SalexHub has the current list.
The claims in this post were checked against the product's code at salexhub/platform 3313253a4.