Asking first and permissions

Your request authorizes ordinary app work. Payments and API keys stay protected, and you can choose stricter permissions.

Confirm cards

Your request authorizes ordinary work in your connected apps: reads, drafts, sends, edits, calendar invitations, shares and deletions can run without another confirmation. Your helper must stay within the account, recipients and content you requested, and respect stricter permissions you chose.

Payment and API-key operations retain a protected confirm card showing the exact action, with Confirm and Cancel. Purchases through Link also require your approval in Link.

• A protected action does not run until you tap Confirm, in the app or from the card texted to your phone. Your helper can't confirm it for you.
• The card covers that exact action. If the content changes, you get a new card.
• An unclear request can still need a question about the account, recipient, date or other missing detail. That is different from confirming ordinary work you already requested.
• Your helper never acts because an email, a document, a web page or something in an app told it to. That content is information, never instructions.

Protected approvals and permission asks

• Payment and API-key operations use exact-action confirmation, including through an app's own API.
• Purchases through Link require your approval in Link.
• Bookings: your helper checks the exact option, date and time, total and cancellation terms before committing.
• Filling in your personal details on a website needs permission unless you have already allowed it (see below).

Which account?

With two or more email or calendar accounts connected, a new request gets "Which email should I check?" with each account and All of them as one-tap choices. Your answer is saved, so it won't ask again for the same thing. A note on an account ("my work email") answers it too. See Account notes.

Permission levels

In Settings → Permissions, choose one level for your whole account:

Each ask is a card with Allow once, Always allow and Don't allow, in the app or by text. Everything you've always allowed is listed in Settings → Permissions, with Remove.

Custom MCP tools have their own permission category, including at Standard. Connecting a server does not grant permission to run all its tools.

Agent check-ins

Settings → Permissions → Agent check-ins controls when your helper gives an update as it works: the number of tool calls before the first update (15 by default), and within a rolling 60 seconds (20 by default). Each accepts a whole number from 1 to 1,000 and has its own Save button. These are separate from Pause to check spending; they do not change purchase or permission approvals.

Your personal details on websites

The first time a website form needs your name, phone, email, address or birthday, your helper asks: Allow once, Always allow filling in your details or Don't allow. It never types passwords (it uses your saved logins or hands you the browser), card numbers, or ID numbers like a passport or Social Security number.

Paying for things

Purchases go through Link, Stripe's wallet, which you add in Settings → Wallet. You approve each purchase in Link before any money moves, and the store gets a one-time card number locked to that store and amount. Your helper never sees your real card. Up to $500 per purchase, one purchase per approval. If the total changes before paying, it stops and asks again.