---
{
  "id": "platform.cron.confirmation-limits-and-safety",
  "topic": "cron",
  "title": "Cron confirmation, limits, and safety",
  "locale": "en",
  "version": "2026-09-06",
  "summary": "Cron create and update remain confirmation-free, while target-specific validation, a 50-notify daily cap, action allowlisting, owner-visible controls, and hard quotas bound execution.",
  "content": "Cron reads, create, and update use `ConfirmationPolicy::None`; `cancel_job` and `run_now` use `UserConfirm`. Schedule/update persist after validation and quota checks. Workflow, notify, and outbound targets add no confirmation. An `action_call` must itself need no confirmation, progress, or cancellation and must be current; Cron, Trigger, Workflow, Agent, and Memory namespaces are denied. Owners can inspect, pause, replace, or cancel jobs.\n\nLimits are 200 active jobs per owner, 20 recurring, and 200 fires per rolling day; notify also has a 50-fire owner cap. Agent-bound targets additionally have 100 active, 10 recurring, and 100 daily fires, plus 50 per conversation when applicable; notify/outbound attribution does not consume an Agent envelope. Manual fires count too. Pending deliveries reserve quota alongside delivered fires; only the exact recovered occurrence reuses its reservation. Create/replacement projects RRULE load under every applicable envelope. Ten consecutive quota skips auto-pause; cross-Agent recurring schedules are rejected.\n\nFire time rechecks every target shape and mutable dependency: notify title/URL; outbound endpoint, event/template, rendered cap, price, limits, Redis, wallet, and DB outcome; action registry policy, schema, and rendered argument size. Same-occurrence IDs deduplicate side effects/results, and legal actions execute detached.\n\nAll ten Cron actions are forbidden on public surfaces. Owner and Agent scope applies to reads and writes. Messages are redacted; idempotency, audit, billing, quota, and permissions remain enforced. The owner can manage every job and inspect fire history.\n\nAgent access uses per-job grants; mutation requires write. Agent-less schedules have no floor. A bound Agent's write floor cannot be removed, and deleting it cascade-deletes its jobs.\n",
  "aliases": [
    "cron confirmation",
    "schedule quota",
    "public conversation restriction",
    "confirmation-free schedule",
    "daily fire limit",
    "long scheduled message"
  ],
  "tags": [
    "cron",
    "confirmation",
    "safety"
  ],
  "relatedActions": [
    "arinova.cron.schedule",
    "arinova.cron.list_jobs",
    "arinova.cron.list_fires",
    "arinova.cron.get_job",
    "arinova.cron.update_job",
    "arinova.cron.set_enabled",
    "arinova.cron.cancel_job",
    "arinova.cron.run_now"
  ],
  "relatedActionPrefixes": [],
  "url": "https://docs.arinova.ai/en/kb/cron/confirmation-limits-and-safety/"
}
---

Cron reads, create, and update use `ConfirmationPolicy::None`; `cancel_job` and `run_now` use `UserConfirm`. Schedule/update persist after validation and quota checks. Workflow, notify, and outbound targets add no confirmation. An `action_call` must itself need no confirmation, progress, or cancellation and must be current; Cron, Trigger, Workflow, Agent, and Memory namespaces are denied. Owners can inspect, pause, replace, or cancel jobs.

Limits are 200 active jobs per owner, 20 recurring, and 200 fires per rolling day; notify also has a 50-fire owner cap. Agent-bound targets additionally have 100 active, 10 recurring, and 100 daily fires, plus 50 per conversation when applicable; notify/outbound attribution does not consume an Agent envelope. Manual fires count too. Pending deliveries reserve quota alongside delivered fires; only the exact recovered occurrence reuses its reservation. Create/replacement projects RRULE load under every applicable envelope. Ten consecutive quota skips auto-pause; cross-Agent recurring schedules are rejected.

Fire time rechecks every target shape and mutable dependency: notify title/URL; outbound endpoint, event/template, rendered cap, price, limits, Redis, wallet, and DB outcome; action registry policy, schema, and rendered argument size. Same-occurrence IDs deduplicate side effects/results, and legal actions execute detached.

All ten Cron actions are forbidden on public surfaces. Owner and Agent scope applies to reads and writes. Messages are redacted; idempotency, audit, billing, quota, and permissions remain enforced. The owner can manage every job and inspect fire history.

Agent access uses per-job grants; mutation requires write. Agent-less schedules have no floor. A bound Agent's write floor cannot be removed, and deleting it cascade-deletes its jobs.