Escrow, or effect escrow, is how Heighliner handles actions that cannot be undone. You can roll back a database, but not a sent email or a webhook a partner already processed.
So an irreversible side effect is not executed when the agent asks for it. It is staged in an outbox and released only when a person approves it and the run commits. If the request is rejected, or the run fails, the effect is cancelled and nothing leaves.
While an action waits in escrow, the agent is paused and does not use compute. Approval state lives in Heighliner, so you can answer in Slack, ChatGPT, Claude or the console.
Related
- Effect classAn effect class labels every agent action by how hard it is to undo: pure, reversible, compensatable or irreversible. Policy and approvals follow from it.
- Approvals without rubber-stampingAsking a person to approve every agent action turns oversight into clicking yes. Effect classes, escrow and saved rules keep approvals rare and meaningful.
- Nightly reports that are drafted automatically and sent deliberatelyRun an agent every night to pull metrics and draft a report. Sending email to customers is irreversible, so it waits in escrow for a person to approve.