Authorization and approvals
Approval decides whether an action proceeds. Check the action, target, account, and effects before accepting it. Installing a plugin, trusting a workspace, or enabling a skill does not authorize its operations.
Choose by task
| Mode | Tool and computer actions | Choose for |
|---|---|---|
| Confirm every step | Present actions requiring approval to the user | First use, unfamiliar folders, and individually inspected actions |
| High-risk only | Allow actions classified as low risk and ask for higher-impact actions | Routine work with a defined scope and important confirmations retained |
| Automatic | Automatically review tools while parameter-level risk checks retain prompts; computer actions retain their confirmation boundary | Validated workflows with fewer routine prompts |
| Full access | Relax tool approval and computer confirmation and request the sandbox strength allowed by the surface | Tasks with explicitly understood access and effects, never a way to dismiss a failure |
Inspect approval and execution isolation separately. Full access requests the sandbox strength allowed by the surface. Only surface- and policy-allowed choices appear. Browser operation excludes full access. Do not switch surfaces to bypass restrictions. Spending, trust-ledger changes, and leaving Plan have separate confirmation paths.
For example, restrict a meeting-note task to its source folder and output file. Start with step-by-step confirmation; after checking reads and output, use high-risk-only if appropriate. Sending the notes still requires checking recipients and content.
Confirm the selection and outcome
Check the mode shown below the composer, then submit a narrowly scoped task. Inspect approval targets, tool results, and the actual output. Verify mode selection, approval, and completion separately. Read disabled-option explanations rather than changing project rules to bypass surface policy.
Review a request
- Check the tool, path, destination, and active account.
- Inspect recipients and irreversible effects for sending, deletion, publishing, and payment.
- Approve only the required scope. After rejection, narrow the task or prepare a draft or read-only check.
- Distinguish approval, execution, and successful completion in the result.
Rule simulation
The permissions settings panel manages and simulates rules; it does not govern live tool approvals. An allowed simulation neither runs the tool nor approves later actions. Use the session permission control and actual approval requests for running tasks.