Agent & tasks · 19 min read · Updated 2026-07-30

Should Agent ask before acting? Choosing an approval level

What Ask every time, Auto-approve, and Allow all permit; when to tighten them; and how to roll back mistakes.

To do real work, Agent needs to touch things: edit files, run commands, write documents, open webpages, and control devices.Whether it asks before actingis controlled by theshielddropdown in the composer.

It has three levels:Request permission,Auto-approve,Allow all. Set it too tightly and approvals interrupt every step; set it too loosely and you may not see changes until Agent finishes. This guide explains exactly what each level permits, which actionsalways stop for your approval, and how to recover if something goes wrong.

Note:Approval levelis different from the adjacentmodeselector (Ask / Run / Plan / PMO). Mode controls what kind of work Agent may do; approval level controls whether it asks before acting. This guide covers approval levels only.

First, check your current level

Open any Agent conversation and find therow of small buttons below the composer. The second button from the left opens approvals. The shield color shows the current level:

Gray shield + “Ask every time” — most cautious
Orange shield + “Auto-approve” — routine actions proceed automatically
Red shield + “Allow all” — almost no interruption

In a narrow window, the label collapses to an icon. Hover over it to see the current level and its description.

The default is the most permissive level. New workspaces start with Allow all, so you can complete work without constant confirmation clicks and tighten it whenever needed. Older workspaces may use another level. Do not guess—the shield always shows the active level. That is why checking it is the first step in this guide.

Where to change it

Entry point 1 (most common): the shield dropdown in the composer. Open it to see all three levels; the current one has a checkmark. Click another to switch.

Entry point 2: Workspace settings → Authorization policy → Approval permissions. The same three levels and rules appear here. This page also shows which directories Agent can access and any remembered approvals.

Entry point 3: the shortcut in the lower-left corner of an approval card. From Ask every time it shows Auto-approve; from Auto-approve it shows Allow all. Hover text says “Raise the approval level for this conversation and allow these actions.” Clicking italso approves the actions currently waiting.

Cases where you cannot switch:

The option shows a “Not enabled by organization” badge → your organization does not allow relaxed approvals; only theorganization ownercan enable them
The option shows a Admin approval required badge → your organization role is insufficient (Editor or above is required)
You areviewing remotelya workspace on someone else's device → remote viewing is always read-only
This is a PMO conversation → fixed to Ask every time, as explained below

Approval levels at a glance

Level	Description in the app	Approved automatically	Still asks you	Best for
Request permission	Ask before actions	Reading files, searching, and viewing logs; editing filesinsidethe workspace; routine commands whose working directory is inside the workspace; opening webpages; Agent's own task list	the workspaceoutsidepaths; deleting files; sensitive files (`.env`,`.ssh`, keys and certificates, browser credentials, and more); writing docs or tables; MCP tools; device control; clicks, forms, and downloads in the browser	New Agent, production or important directories, or work whose intent you are not yet sure about
Auto-approve	Approve routine actions automatically; still ask for high-risk actions	Most items in the “asks” column above: docs and tables, MCP, devices, browsers, and ordinary paths outside the workspace	Deleting files; writing `.env` / `.ssh` / `.aws` , shell scripts, Dockerfiles, and similar sensitive files;`sudo` high-risk commands such as elevation, shutdown, or firewall changes; sensitive files outside the workspace	Long-running bulk changes, trusted working directories, and demos
Allow all	Run without asking for approval	Almost everything except catastrophic red lines,including deletion and writes to sensitive files	No approval prompts remain. Only system-level red linesblocked outright	One-off, tightly scoped work that you are actively supervising

Ask every time: knock before crossing a boundary

This level does not interrupt you at every step. It actuallytrusts your workspace by default:

No approval needed: reading files, full-text search, viewing logs, writing and editing files inside the workspace, running routine commands from a workspace directory, and updating Agent's own task list and plan.

Shows an approval card:

Accessingoutside the workspacefiles, or using an absolute path outside the workspace in command arguments
Deleting files—even if the command's target is inside the workspace
AccessingSensitive files:.env,.ssh/,.aws/,.gnupg/,.kube/,.pem / .key / .p12 Private keys, Git credentials, shell startup scripts, browser cookies and sign-in data, password-manager data, and the macOS Keychain
Writing todocs and tablesand other resources
Calling MCP tools
Controlling devices(such as tapping a phone or operating a desktop; screenshots and read-only queries do not ask)
Mutating actions in the browser(clicking, filling forms, running scripts, setting cookies, or downloading resources). Opening pages, navigating, and switching tabs do not ask

Rejected outright without asking:sudo Privilege elevation, shutdown or restart, stopping critical system services, clearing firewall rules,chmod -R 777,curl … | sh download-and-execute patterns, and writing to /etc,/usr,/bin,C:\Windows system directories; alsowriting to sensitive files outside the workspace.

Auto-approve: routine work proceeds; dangerous actions still ask

At this level, most actions listed above proceed without prompting: Agent can write docs and tables, call MCP, control devices, interact with webpages, and read or write ordinary files outside the workspace.

Still requires approval:

Deleting files
Writing .env,.ssh/,.aws/,.gnupg/, as well as .sh / .bat / .ps1 scripts, Dockerfiles, docker-compose files, and similarSensitive files
High-risk commands:sudo, shutdown or restart, stopping system services, clearing the firewall,chmod -R 777,curl | sh, and writing to system directories
Sensitive files outside the workspace
Deletion commands on Windows whose targets contain variables, wildcards, or otherpaths that cannot be resolved before executioncommands

In short, Auto-approve removesfriction from everyday workwhile preserving checks forirreversible actions and credential access.

Allow all: only catastrophic red lines remain

This level shows no approval cards. Deleting files, writing .env,sudo and elevating privileges all run directly.

Only a small set ofcatastrophicoperations are stillblocked outrightby the system—not sent to you for approval, but rejected:

rm -rf /,rm -rf ~,rm -rf $HOME
fork bomb
dd Writing directly to raw devices,mkfs formatting, Windows format X:, and shell redirection to a raw disk
PowerShell commands whose true contents are hidden, such as encoded payloads or dynamic evaluation, because the system cannot show you transparently what they will do

These operationsare blocked at every level, with no override.

Actions you previously chose to “Deny and remember”also remain blocked at every level.

One counterintuitive rule worth remembering

For sudo privilege elevation, shutdown, firewall changes, system-directory writes, and writes to sensitive files outside the workspace—actions that arehigh-risk but not destructive to the entire device—the three levels behave as follows:

Request permission — Reject outright; you are not offered an approval choice
Auto-approve — Show a cardand let you decide
Allow all — allow directly

If Agent reports “Blocked by system: …” for a command you genuinely need, the answer is usually not to persuade it again, but toraise the level so the blocked action becomes an approval card you can decide.

How long and how broadly a level applies

This is the most commonly misunderstood point:Changing the level does not affect only one action; it changes persistent authorization for the workspace.

The level is stored on theserverand follows theWorkspace. It remains after restarting the app and when signing in from another computer
New conversations use this level by default; you do not need to set it each time
Existing conversations keep any level you set specifically for them—but theymay be stricter than the workspace ceiling, never more permissive
Each workspace has its own independent setting

Two operational details:

Raising the level requires confirmation. A dialog such as “Authorize Auto-approve?” explains what the new level means.Lowering the level takes effect immediatelywithout confirmation
A new level normally takes effect on the next turn—butraising it also approves the batch currently waiting, so Agent continues immediately without another click

Two hard constraints override every setting:

PMO conversations are fixed to Ask every time. PMO dispatches several sub-Agents concurrently, and they cannot see the main conversation. A permissive level would let several executors change things at once without direct review, so it is not available here
If the organization has not enabled relaxed approvals, the entire organization stays on Ask every time

Who can change what

Setting	Who can do it
Organization-wide switch Allow members to use relaxed approvals(Settings → Organization settings → AI service controls)	Organization owner only. Other members do not see this entry point
Raise or lower a workspace approval level	Within an organization, Editor or above; it must also beyour ownWorkspace
Approve or deny an approval card	The person responsible for that conversation's execution
Change the level while remotely viewing someone else's workspace	Not allowed; remote viewing is always read-only

The organization-wide switch is explicit: “Allow members to authorize Auto-approve or Allow all for Agent.This only defines the organization's maximum; it does not switch any Agent automatically.” In other words, enabling it does not loosen every workspace immediately. It merelyallowsmembers to raise their own levels.

How to use an approval card

When Agent needs your decision, aApproval requiredcard appears in the conversation. It shows the action, command or path involved, and badges such asHigh risk / Sensitive path / outside the workspace. Click “View details” to expand the full parameters.

Actions:

allows / Allow once — approve this batch
Deny — the first click changes to “Confirm denial”; click again to deny. You can add a reason for Agent beside it
Remember checkbox + scope dropdown — Remember in this conversation(do not ask again in this conversation) or Remember in this workspace(do not ask again in this workspace, across devices)
The lower-leftraise-level button(Auto-approve / Allow all) — raise the level and approve this batch in one step
Add instruction — send Agent another instruction without interrupting the approval

Approval cards expire. During supervised work, the countdown is roughly 30 minutes. After expiry, the card says “Approval expired,” and you must message Agent to retry.

Entries remembered for a workspace can later be removed under Workspace settings → Authorization policy → Remembered approvals , either one by one or with “Clear all.” Removal takes effect immediately, and Agent asks again next time.

Best practices

Before letting Agent run a long batch of changes

Recommended setting: run the first two or three steps with Ask every time. Confirm that Agent understood the request and is working in the intended directory, then switch toAuto-approveand let it finish.

Why not start with Allow all: the biggest risks in bulk work are deleting the wrong file or corrupting .env . Auto-approve keeps confirmations for those two cases while removing nearly all other friction.

Safety net: before work starts, use the camera icon in the conversation header (Workspace snapshots) and clickTake snapshot now. If the result is unsatisfactory, return to that message and roll back.

When working in production directories or customer data

Recommended setting:Keep Ask every time. Do not trade safety for convenience.

More important: narrow Agent'sworking directory to a specific subdirectory, not your home directory or an entire project root. Workspace boundaries are the real guardrail: the level controls whether Agent asks, while the workspace controls what it can reach without asking. Verify “Directories Agent can actually access” on the Authorization policy page.

Keep remembered approvals narrow: in this scenario, useRemember in this conversation, not “Remember in this workspace,” which persists and syncs across all your devices.

When giving a demo

Recommended setting: switch toAuto-approve. An approval card in the middle of a demo breaks the flow.

Do not use Allow all: mistakes in a demo environment still have real consequences. Auto-approve retains checks for deletion and sensitive files, which also demonstrates that the product has boundaries.

Before the demo: switch the working directory to a dedicated demo directory. Afterwards, switch it back and lower the level to Ask every time.

For scheduled, unattended tasks

Important: unattended scheduled tasksdo not wait for a person to approve them. In this mode, approval requeststime out immediately, ending the task at that point.

Recommended setting: include every required directory in the workspace ahead of time. Run likely repeated actions once while supervising, approve them with “Remember in this workspace,” and future runs can match that memory.Do not rely on Ask every time to protect unattended work. It cannot protect a task with nobody present; it only causes failure.

Sub-Agents inherit your level

Sub-Agents delegated by the primary Agentinherit your current approval level by default. With Auto-approve, sub-Agents also use Auto-approve. Catastrophic red lines apply to them as well.

If something goes wrong: how to recover

TabTin automatically stores versions before and after each Agent turn, so permissive approval does not remove every path back.

Roll back an entire turn, including messages, files, and resources: hover over Agent's reply and choose therollback arrow. Its tooltip says “Roll conversation back to here: remove later messages and restore workspace files and resources.” Clicking it first opensRollback preview — affected items, showing how many messages will be removed, which files restored, and which resources rolled back—you can deselect individual resources to skip them. Review the list, then click “Confirm rollback.”

Undo resource changes while keeping the conversation: use thepackage icon“Undo this AI action. This restores docs, tables, and other resources to their state before the AI action without changing messages. The confirmation warns:Your manual edits to these resources after the AI action will also be undone.”

You can undo a rollback: after rollback, a banner says “Rolled back to a previous version. Click ‘Restore original state’ to undo at any time.You cannot undo after sending a new message. Check the result before sending anything else.

Create a manual checkpoint: camera icon in the conversation header → Workspace snapshots → Take snapshot now. This panel is forbrowsingexisting snapshots and jumping to their conversation point; itcannot roll back directly. Return to the relevant message in the conversation to roll back.

Restore one document or table: openVersion history → “Restore this version.” If a full-turn rollback fails, this is the most reliable fallback.

What rollback cannot recover

Read this section carefully before choosing a permissive level:

External effects of commands cannot be reversed: pushed commits, sent requests, deleted production data, and installed dependencies are not “un-executed” by rollback
Files changed by terminal commands are conservatively excluded from automatic rollback. The app states: “Not covered by automatic rollback: changes made by terminal or shell commands, files you edited manually, and files not tracked by file tools.” Do not treat rollback as insurance
Files created by Agent are deleted, while newly created resources aremoved to the recycle bin(not permanently deleted)
Workspace files you edited manually are left untouched; rollback changes only items tracked by Agent
Version history has a retention period: roughly 7 days on Free, 30 days on Pro, and 90 days on Team. Expired versions are removed
You may lack permission to roll back a checkpoint created by someone else and be asked to contact them

In short:Rollback can undo files and resources, not events that have already happened in the outside world.For messages, payments, releases, and other irreversible actions, keep Ask every time and approve them yourself.

How to see what Agent did

The conversation is the most detailed record: every tool call appears in the message stream, including entries such as “Calling XXX,” “File changed: path,” and “Turn complete,” plus each turn'sTurn outputscard
Rollback previewexplains what Agent was doing at the time, including intent, result, and key decisions
Rollback history: “View rollback history” in the banner lists each rollback's type and whether it succeeded, partially succeeded, or failed
At the resource level: version history for docs and tables distinguishes “AI edit” from “User edit”

One limitation:the desktop app does not currently have an “Agent audit log” page. Organization-level auditing recordsadministrative actions, such as members, permissions, and resources—not individual Agent tool calls. To reconstruct exactly what Agent did,return to the conversationfor the complete record.

FAQ

Why am I still seeing approval cards after changing the level?

The level issnapshotted at the start of each turn, so a change takes effect on thenext turn.

One helpful exception:raising the level also approves the batch currently waiting, and Agent continues immediately. When a card is blocking progress, the quickest option is the raise-level button in its lower-left corner.

Does changing this conversation affect other conversations?

New conversations do, because the change updates the workspace's approval ceiling.

Existing conversationskeep any level set specifically for them, and may be stricter than the workspace ceiling but never more permissive. Other workspaces are unaffected.

Why are Auto-approve and Allow all disabled?

There are three possibilities; check the badge on the option:

“Not enabled by organization” — Your organization owner has not enabled “Allow members to use relaxed approvals.” Ask them to enable it under Settings → Organization settings → AI service controls
Admin approval required — Your organization role is insufficient; Editor or above is required
This is a PMO conversation, or you are remotely viewing a workspace on someone else's device

What happens if I ignore an approval card?

During supervised work, the card has a countdown of about 30 minutes. When it expires, it says “Approval expired,” that step stops, and you must message Agent to retry.

Unattended scheduled tasks behave differently: with nobody present to click, approvalstime out immediately, and the task fails.

What is the difference between remembering in a conversation and in a workspace?

Remember in this conversation — Conversation: do not ask again here; ask again in another conversation
Remember in this workspace — Workspace: persist across the entire workspace andsync to your other devices

When unsure, choose the conversation scope. To undo a remembered workspace approval, remove it under Workspace settings → Authorization policy → Remembered approvals, or choose “Clear all.”

Does Allow all permit absolutely everything?

No. Catastrophic red lines are always blocked:rm -rf /, fork bombs, disk formatting, direct writes to raw devices, and encoded commands whose true contents cannot be shown. No setting can override these blocks.

Anything you explicitly chose to “Deny and remember” also remains blocked at every level.

Will a permissive level make Agent change things at random?

No. The level only controlswhether Agent asks first. It does not change Agent's intent or expand what it can access—directory access is controlled by workspace boundaries, not the approval level.

To truly narrow access, change Agent's working directory instead of only changing the level.

Do sub-Agents use my approval level?

Yes, they inherit it by default. Catastrophic red lines still apply.

Agent deleted or damaged something. What should I do first?

Do not send another message yet. Sending it closes the rollback window.

First hover over Agent's reply and click the rollback arrow. Review exactly what will be restored in Rollback preview before confirming. If only a doc or table was damaged and you want to keep the conversation, use “Undo this AI action.” If a full-turn rollback fails, restore the affected doc or table separately from Version history.

Still stuck?

Take a screenshot that includes the composer controls and shield level, and send it to contact@larchiveai.com. We will help you diagnose it. Beta users can also ask their contact in the group.