Skip to content

Safety Classes (Reference)

The four safety classes and what each requires before it runs.

Updated September 2, 20261 min readPostsale CLI
ClassMeaningNon-TTY
readSafe; some not auto-retriedOK
idempotent-writeState changeUsually OK; bulk operations and webhooks rotate-secret still require --yes
destructivePermanent / irreversible--yes required
money-movingCarrier charge/void--yes required

Agent money tools

create_shipment, purchase_labels, void_shipment

Agent destructive tools

delete_carrier, delete_origin_address, delete_filter, delete_template, delete_shipping_rule, delete_automation, delete_shipment, create_end_of_day_manifest

Dry-run intercept set

Money + destructive + set_order_status + bulk_set_order_status

Not intercepted: create_order, update_order, update_shipment, tagging, bulk field edits, filter create/update

Parallel batches

Batch authorization independent of --yes. Non-TTY: POSTSALE_SWARM_AUTOAUTH=1.

Full narrative: handbook/04-safety-model.md.