How do AI teammates handle approvals and sensitive steps?

What it is

An approval step is a pause where the agent asks a person before it acts. For background agents, it’s the main control that keeps automation safe.

How it works

• Standing boundaries: write what the agent may and may not do into its role description.
• Rules that require approval: Grok Bot’s FAQ describes Auto-review rules and narrow “Ask first” rules so sensitive or consequential actions stop for approval.
• Human-only steps: passwords, two-factor codes and CAPTCHAs go to the user through a computer takeover rather than being guessed or bypassed.
• Other platforms’ defaults (checked 2026-10-16): Cursor asks before terminal commands and other sensitive actions by default. Codex works inside a sandbox and an approval policy decides when it stops to ask. Claude Code’s auto mode has a classifier model review actions such as shell commands and network requests, and its Manual mode asks before most edits and commands. Antigravity’s Default preset asks before commands that leave its sandbox, before web browsing and before MCP tool calls. See letting an agent act safely for detail.
• Read-back: for voice or chat agents, restate the action (“Send the invoice to Acme for $1,200?”) before doing it.

Benefits

• Lets you delegate routine work without giving up control of risky steps.
• Makes the human decision point explicit for each risky step.
• Builds trust gradually: widen permissions as the agent proves reliable.

Limits and risks

• Too many approvals slow everything down; target only consequential actions.
• Approval fatigue leads to rubber-stamping; keep requests specific.
• Approvals don’t replace least-privilege access; see letting an agent act safely.