When a playbook reaches an email, webhook or API step, the most specific enabled rule decides what happens. A rule scoped to a provider beats one scoped to an outcome, which beats one scoped to an action type. With no rule at all, everything waits for a reviewer.

​
A rule

A step can also demand approval regardless of the rules, from its playbook. Only admins add, edit or delete rules. The starter knowledge base ships three rules that hold every email, webhook and API step for approval; loosen them once you trust a step.
Start with dry run on and every step held. Approve a few, read the request and response on the case’s Activity tab, then write a Run automatically rule for that one provider and outcome.