Capabilities
A person can always take the wheel.
Autonomy is a dial, not a switch. Health Loops lets you decide which tools a loop may use, which actions wait for a person, and which moments always leave the agent and go to a human.
Money and bulk sends wait.
Refunds, discount codes and messages to more than one person can return pending approval instead of acting.
Tools are off until you turn them on.
A loop gets only the tools and bindings switched on in its Controls tab. A call to an off tool throws.
Hosts are allowlisted.
Loop code can reach only the hosts you list. Anything else fails before the request is made.
Urgent symptoms go to people.
Red-flag checks and emergency routing return the number to call and tell the person to use it.
How it works
The mechanism, in order.
- Choose the guardrail. An approval on an action kind, a tool switch, an allowed host, or a consent screen before a scan.
- The loop tries the action. A held call returns { status: "pending_approval", approvalId, message } instead of acting.
- A person decides. The request appears on the Approvals page. Approve runs it then; reject drops it.
- The run continues. The loop receives the result and carries on. The approval and its outcome stay on the record.
- The exception reaches a person. A red flag, an emergency or a request outside the loop goes to your team with the details attached.
const refund = await step.do("Refund the order", async ({ ctx }) => {
return ctx.SHOPIFY.refundOrder({ orderId: event.body.orderId });
});
if (refund.status === "pending_approval") {
// A person sees it on the Approvals page. Approve runs it; reject drops it.
console.log(`Refund ${refund.approvalId} is waiting for a person`);
}The specifics
What you get, and where it stops.
Approvals. Three action kinds can be held: refunds through ctx.SHOPIFY.refundOrder, discounts through ctx.SHOPIFY.createDiscountCode, and bulk messages through ctx.SMS.send, ctx.WHATSAPP.send or ctx.EMAIL.send to more than one recipient. All three are on for new loops.
Tool controls. Every loop has a Controls tab for tools, allowed hosts and approvals. Changes apply from the next run or message, not to work already in flight.
Consent. A face scan runs behind a consent screen. The scan gives wellness readings, not a diagnosis, and the person chooses whether to continue.
Health safety. The platform provides emergency and crisis lines by country and a fixed symptom red-flag list with three outcomes: self-care, see a GP within days, or urgent. The number and the red flag come from code, not from the model.
Versions. A deploy is a new version. In-flight runs finish on the version they started with, and rollback picks an earlier one.
Where it stops. Approval is per action kind, not a general policy engine with custom conditions. Rules that depend on your own thresholds live in loop code, where you can test them.
Sources
The pages behind these claims.
FAQ
Questions
Can we require approval on every message?
Approval covers bulk messages to more than one recipient, not single sends. For a stricter rule, check the recipient count or content in code before calling the binding.
Who approves a held action?
A person on your team with access to the organisation opens the Approvals page. Approve runs the action then; reject drops it.
Can a loop give a diagnosis or prescribe?
No. Ollie is a wellness product, not a medical device. Loops give wellness guidance, do not diagnose or prescribe, and hand off to a human expert.
What happens when a red flag fires?
The tool returns the fixed red-flag result and, where relevant, the emergency or crisis line for the country. The loop tells the person and routes the case to your team; the model does not decide the red flag.
Can a loop act on its own at all?
Yes, within the tools and hosts you switch on. Approvals are for the three action kinds you choose to hold. Everything else runs and is recorded.
Ollie’s agents give wellness guidance. They don’t diagnose or prescribe, and they hand off to a human expert when it matters.
See the mechanism on your own journey.
