Agents / Approvals
When do personal AI agents ask first?
What each of 26 agents says about asking for approval before it sends, buys or changes something, in the maker's own terms. Settings and defaults change, so check the source before you give an agent access.
| Agent | Approval model | Source |
|---|---|---|
| Alexa+ | Not stated in detail. Amazon says Alexa+ can complete some web tasks behind the scenes without supervision, and On Screen Intelligence on Alexa Tablets is off by default and needs an opt in. | Amazon: Introducing Alexa+ (updated July 21, 2026) checked Oct 15, 2026 |
| Ambi | Its Terms say it acts only on user instruction or confirmation, irreversible actions need express authorization, and it will not modify a connected calendar or send external communications unless instructed; the homepage says anything that cannot be undone waits for approval. | Official homepage checked Oct 15, 2026 |
| ChatGPT dots | Built-in rules decide when the dot acts alone and when it asks. Custom Rules let the user set an action to take action without asking, take action if pre-approved, ask before taking action, or hand off to the user. Auto-review checks actions that could affect accounts or share information. Some steps, such as changing a password, always stay with the user. Background proactive research uses read-only tools. | OpenAI launch post: Introducing dots checked Oct 15, 2026 |
| Claude (with Claude Cowork) | By default Claude asks before taking an action; users can let it keep working and check in only when something needs a closer look. In Claude in Chrome, actions a classifier judges safe are approved automatically and actions that do not match the request are blocked; this can be switched off. Claude still asks before certain irreversible or costly actions such as purchases or sharing personal data. | Claude pricing page checked Oct 15, 2026 |
| Comet | When an advanced agent or automation runs for the first time, Comet asks the user to allow it once, always allow it or not allow it. Comet asks for approval before connecting to services such as Gmail, users can block sites, and organization admins can turn the Always allow option on or off. | Comet product page checked Oct 15, 2026 |
| Eney | MacPaw states that by default Eney asks before it sends a message, changes an event or moves a file, and the user decides how much it can do on its own. | Official site and pricing checked Oct 15, 2026 |
| Fo | Wajo says its agents can work in draft only mode, ask for approval before acting, or handle defined work on their own, and are designed to ask before hard to reverse actions. Purchases use single use cards, and tasks the agent cannot finish can be passed to trained human assistants. | Official site and pricing checked Oct 15, 2026 |
| Gemini Spark (Tasks in Gemini) | Gemini is designed to ask for review and confirmation before sending communications, modifying data, making purchases, submitting web forms and signing in with Google, and it asks for confirmation before every task that involves web browsing. Google notes it can perform bulk actions on private Google Tasks without confirmation, and a schedule that runs while the user is offline may not be stoppable. | Gemini Apps release notes checked Oct 15, 2026 |
| Genspark Claw | Help center states external actions such as sending emails or posting messages require permission; messaging channels default to a pairing mode where only approved contacts can message Claw. Scheduled tasks and the optional Heartbeat mode run in the background without a prompt. | Product page checked Oct 15, 2026 |
| Grok Bot | Auto Review evaluates tool calls and computer actions before they run, with user rules set to Ask first or Allow automatically; Ask first wins when both match. Before actions it cannot undo, such as sending, posting, buying or deleting, a Bot checks for approval; emails go out from draft cards and purchases show an Allow or Deny card. Running commands on the user's own computer defaults to Ask every time. | xAI launch post: Introducing Grok Bot checked Oct 15, 2026 |
| Hark Pro | The homepage says it checks in with the user before doing something that requires approval; action buttons let the user approve tasks such as paying a bill with a tap, and the launch post says it can handle some tasks on its own if the user allows it. | Official homepage checked Oct 15, 2026 |
| Hermes Agent | Dangerous shell commands require approval. The default smart mode uses an auxiliary model to auto approve low risk commands, auto deny clearly dangerous ones and ask the user in uncertain cases; manual mode always asks and off (YOLO) disables prompts. Cron, single query and unattended sessions deny dangerous commands by default, a hardline blocklist can never be overridden, and checks are skipped inside container backends. | Official site and FAQ checked Oct 15, 2026 |
| Lindy | Pricing FAQ states anything with outside impact waits for approval, such as sending an email, updating a ticket, posting to another channel or publishing a doc; read only lookups from approved sources do not require approval. | Pricing page checked Oct 15, 2026 |
| Manus | For automations that send or publish, the maker recommends keeping Approval required on so Manus waits for confirmation, and Test run shows a real result first. Computer Use on the user's machine works only in a connected and authorized session with the files, browser and apps the user approved. | Official site checked Oct 15, 2026 |
| Microsoft Copilot | Microsoft says Copilot asks for approval or hands control back before sensitive actions, and users can stop, pause, take control of or delete a task. On Windows, local context and actions are described as working with the user's permission. | Microsoft blog: new Copilot with Home, Code and Autopilot checked Oct 15, 2026 |
| Muse | Muse checks with the user before sensitive actions such as sending an email or making a purchase and shows an audit trail of past and planned actions. A separate Sentinel agent must approve anything Muse sends to the internet and asks the user when needed. Users set per-app access, and Muse cannot see stored passwords or payment details. | Meta Newsroom: Introducing Muse checked Oct 15, 2026 |
| NanoClaw | Agents run in isolated containers and never see real credentials; an OneCLI credential gateway checks user defined policies and pauses sensitive outbound requests until the user approves them through a native card in the chat app. The FAQ also lists egress lockdown, mount rules and sender policies. | Official site and FAQ checked Oct 15, 2026 |
| OpenClaw | Configurable. Host commands run only when tool policy, the allowlist and optional user approval agree; modes are deny, allowlist, ask, auto and full. The docs state the default is security full with ask off on gateway and node hosts, and deny on sandbox hosts, so prompting depends on configuration. Approval prompts can be answered in the companion apps, the Control UI or supported chat channels. | Official site checked Oct 15, 2026 |
| Opera Neon | Neon Do shows its planned steps and runs visibly, and the user can pause, stop or take over at any time. External agents connected over MCP are read only by default, and clicking or filling in forms needs explicit permission. | Official site checked Oct 15, 2026 |
| Pally | Official facts page states Pally checks with the user before it sends, books or buys anything the user has not already asked for or approved; payments go through the connected wallet's approval settings. | Facts page checked Oct 15, 2026 |
| Perplexity Computer | Connector tools can be set to Always ask, so the user approves a single action, allows the tool for the thread or denies it; Automations can pause for review before consequential actions, and Portable Computer asks permission before sending device content to the cloud. | Product page checked Oct 15, 2026 |
| Persona | The official FAQ says anything that spends money, sends words in your name or cannot be undone waits for your yes; TechCrunch reports payments run through external providers such as Stripe Link so the agent does not see card numbers. | Official homepage checked Oct 15, 2026 |
| Rene | Its FAQ says it can draft the next step and asks before anything sensitive is sent or changed; the founder's launch post says it always asks before it pays. | Official homepage checked Oct 15, 2026 |
| Siri AI | Not stated | Apple Newsroom: Siri AI is here checked Oct 15, 2026 |
| Town | By default it asks before it sends or changes anything; users can ease approvals per action, pre-approve email recipients, and let it finalize calendar bookings or scheduling replies without asking. | Official homepage checked Oct 15, 2026 |
| Underdog | Official site says it gets the next step ready for the user's approval on sensitive tasks, and purchases are paid with a one time Link card the user approves. AI processing runs locally and an offline mode can block all calls home. | Official site checked Oct 15, 2026 |
Track them every week