Approval behavior depends on the configured host, runtime, tool policy, and channel. Not every action is automatically approval-gated. Do not assume a running assistant is sandboxed.
Read the actual request
Check the action, host, working directory, scope, and intended result. Prefer a one-time approval when that matches your request. Deny an unclear action and ask for a narrower explanation.
Chat approval syntax
The approval ID comes first, followed by the decision. Replace REQUEST_ID with the exact pending ID, or use the buttons supplied by the prompt:
/approve REQUEST_ID allow-once
/approve REQUEST_ID allow-always
/approve REQUEST_ID denyChoose one decision, not all three lines. A persistent allow decision can authorize matching future operations when supported; do not grant it casually. Some policies do not allow persistent approval, and an expired or changed request needs a fresh review.
Different layers do different jobs
- Tool policy: which capabilities are available.
- Sandbox: where execution can run and what it can reach.
- Approval: whether a particular gated action can proceed.
- Channel policy: who can request or approve actions.
An exec approval is not blanket authorization to publish, purchase, or expose data. After sensitive work, check the actual artifact or receipt.