Approvals & control
Review proposed actions and choose where the agent should pause for your decision.
approve reject deny allow ask safety human reviewOn this page
Review an approval requestDecide what needs approvalRun without pausing using auto modePermissions still applyWhen work appears stuckReview an approval request
Some actions pause and wait for you before they run. The approval card in the conversation shows the tool, the action, and a preview of what it will do. Read the target and the values — recipients, amounts, dates, and anything with an outside or irreversible effect — before you decide.
Maya’s Gmail account proposes an email to alex@northstar.example about reviewing the portal. Allow, deny, request an edit, or allow future actions for that account.
The card gives you four choices:
| Choice | What it does |
|---|---|
| Allow | Run this action once, as shown. |
| Deny | Skip this action. Tell the agent what to change; it can propose a corrected action. |
| Request edit | Send the action back with a change instead of a flat refusal. For an outgoing email you can edit the subject and body inline before it sends. |
| Always allow this | Run it now and stop asking for this kind of action. For a connector, Always allow for {account} limits that standing permission to one connected account, so approving a send from one mailbox never auto-sends from another. |
A denied or edited action does not undo work that already finished. If a later request is rejected, an earlier completed action stays done — check the affected record rather than assuming a reject rolled everything back.
While a request is waiting, the chat is paused. Approve or dismiss the pending card to let the agent continue. A request left unanswered expires after 24 hours.
Decide what needs approval
Every action has a risk category, and that category sets whether it runs on its own or asks first:
This example allows reading files and asks before sending email or deleting a file. Actual defaults vary by tool.
| Risk category | Typical default | Examples |
|---|---|---|
| Read-only | Runs without asking | Searching records, reading a file, listing calendar events |
| Mutating | Varies by tool | Creating or updating a record |
| Destructive | Asks first | Deleting records, removing fields |
| External | Asks first | Sending email, posting to a connected service |
| Admin | Asks first | Changing settings, users, or permissions |
Open the agent's Approvals settings to see the catalog of tools and their individual actions. For each one you can set Allow or Always ask, reset an action to its default, or apply a choice to a whole risk group. Sensitive actions have a deliberate default — for example, creating or installing a skill asks first, because a saved skill becomes standing instructions that outlast the conversation.
A good setup lets routine reads run freely and keeps a review point on changes that leave the workspace or cannot be undone. The right balance depends on how much responsibility you have given that agent.
Run without pausing using auto mode
Each conversation has a permission menu next to the model picker. Always ask follows the approval rules above, so actions that need approval wait for you. Auto mode runs approval-gated actions in that chat without stopping to ask — useful once you trust a routine and want it to finish end to end. Switch back to Always ask to return to reviewing each request. You can set your default for new conversations in agent settings; auto mode still respects the agent's permissions and never grants access it does not already have.
New automations created through setup or the agent run automatically by default. Creating one pre-approves the actions described in its task, including app and integration actions. They use existing permissions and accounts; a conversation's Auto mode does not change an older automation's saved authorization.
Permissions still apply
Approval is consent to one particular action. Permission decides whether the agent may perform that kind of action at all. Approving a request cannot grant access to a restricted app, mailbox, or record.
For a personal agent, the owner's access applies. For a shared agent, its own grants apply, and for an interactive request the person who started the task matters too. See permissions and access groups.
When work appears stuck
Check the conversation and the Approvals area for a request waiting on you. If nothing is pending, look at the most recent tool result for an error. A disconnected account, a denied permission, or an empty credit balance each needs a different fix.
Do not resend the same write while an earlier request is still pending. After a connection interruption, check the target record before retrying so you do not create the same thing twice.