Approvals and safety

Tools that only read (search, read a file, get the weather) run straight away. Tools with side effects (write files, run commands, send messages, click or submit in the browser, take photos, schedule jobs) ask first.

The approval card#

A Permission needed dock appears above the composer: "The assistant wants to …", with a summary of exactly what will happen (URL, target fields, command, repo/branch, email recipients…).

• Allow – this one time.
• Allow for this chat – similar actions in this chat run without asking.
• Always allow – permanently for this tool (manage later in Tool approvals).
• Deny – optional reason, or type what CX should do instead ("Or tell the AI what to do instead…").

Several pending approvals are shown "1 of n". Bulk email sends show Allow all / Deny all / Review individually.

Permission mode#

In Add to task → Permission: Manually approve (default; asks before every change) or Automatically approve (works on its own and stops only for payments, logins and codes).

Approval preferences#

Your own rules that CX reads before every task (Settings → Permissions and approvals, or Add to task → Approval preferences). Add a rule under Always ask or Don't ask, e.g. "booking a cab under ₹300". CX skips its own check-in for "Don't ask" rules, but app approval cards still apply. Payments, logins and verification codes always go through their secure card. You can also tell CX in chat; it saves rules with the approval_rules tool.

Tool approvals page#

Settings → Permissions and approvals → Approvals lists every tool you granted with "Always Allow", with Revoke and Revoke all. Browser rules are fixed:

• Browser access: chat-scoped (Allow for this chat).
• Submit actions: always require approval (you review URL, fields and final action).
• JavaScript actions: always require approval.

Hardline blocks#

Some commands are blocked before any approval and can never be allowed, even with auto-approve: deleting system or home folders (rm -rf /…), raw disk overwrites (dd of=/dev/sd…, mkfs), shutdown/reboot/halt, fork bombs and kill-everything commands.

Auto-approve everything#

The switch "I AM STUPID — auto-approve everything" turns off every prompt (shell, SSH, file writes, screen automation, Telegram, MCP). You must confirm a scary dialog. Hardline blocks still apply. Leave it off unless you really know what you are doing.