A post written by a team member, or by an agent through its API token, now always lands in Drafts for an owner or admin to approve, even when the organization does not review every post. The composer button says "Submit for review" for them. The reason is security: a stolen member session or a leaked agent key can no longer post on every connected network. The API announces it in advance (must_draft on targets), and the Claude skill and the MCP server tell the agent to say "it is in Drafts" instead of "published".