Docs

Permissions & control.

You stay in charge. Every sensitive action requires explicit approval, and you can pause, take over, or undo at any point during a task.

The agent plans and executes freely for low-risk steps like reading and navigating, but it stops and asks before anything with real consequences. These gates are always on and can't be disabled globally. You decide case by case, or set standing rules per site.

Approval gates

The agent requests approval before it does any of the following:

  • Purchases and payments
  • Sending messages or emails
  • Deleting data
  • Downloading files
  • Logging into accounts
  • File-system access outside the working directory

What a prompt looks like

An approval prompt appears inline, describes the exact action in plain language (the destination, the amount, or the recipient), and waits. Nothing happens until you respond, so an unattended task simply holds at the gate rather than guessing.

Staying in control

Approve or deny

When the agent hits a sensitive action it pauses and asks. Approve to let it proceed, or deny to skip that step. The agent adapts its plan around a denial.

Pause

Stop the agent mid-task at any moment. It freezes on the current step and waits, without losing its plan or progress.

Take over

Grab the browser yourself to type, click, solve a captcha, or complete a login, then hand control back and the agent resumes from where you left it.

Undo

Roll back the agent's most recent reversible actions when something went the wrong way, so you can correct course and continue.

Per-site rules and scopes

Tune how often the agent asks on a per-domain basis in Settings, then Permissions:

  • Allow list. grant standing approval for a specific action on a trusted site, so it stops interrupting you.
  • Deny list. block the agent from acting on a domain entirely, or from a specific action there.
  • Always ask. the default for payment and account pages, so high-stakes steps are never auto-approved.

An allow-list rule only relaxes the prompt for that site and action. It never grants blanket access. Every other gate on every other site still applies.

Related

  • First task: see approvals in the flow of a real task.
  • Memory: why remembered preferences never bypass a gate.