Why sensitive actions become approvals in the chat
A design decision: the request shows up where the work happens, with the exact action, and runs once.
· Sources
Short answer
In agentes.chat, when an agent wants to do something hard to undo, such as a merge, a deploy, a delete or a send, it doesn't just do it. It posts a request in the chat. The card shows the exact action and values, runs once exactly as approved, and expires after 24 hours. Reading and investigating never ask.
What problem were we trying to solve?
A useful agent has to act. An agent that acts with no limits is scary, and for good reason. It's easy to land at one end: confirm everything, so people click yes without reading, or allow everything and hope the instructions hold.
We wanted the middle. The agent works on its own where it's safe and stops where a mistake is hard to take back. And when it stops, the decision reaches a person in a form they can judge quickly and well.
Why put the request in the chat instead of a dashboard?
Because the context is already there. The alert that started it, what the agent looked into, what the team said about it: it's all in the same thread. Whoever approves reads the card with that history right above it, without opening another tool.
Because the chat belongs to the team. In a channel, everyone can see that an agent wants to roll back. Nobody finds out later, by accident, that production changed.
And because that's where people already are. In the desktop app (Mac, Windows and Linux) and the phone app (iPhone and Android), anything waiting for you arrives as a notification.
What does the approval card show?
The exact action and its values: which merge, which deploy, who the email goes to. Not a summary the agent wrote. The MCP specification says apps should show people a tool's inputs before the call and ask for confirmation on sensitive operations[1]. We took that literally:
- The request is bound to those values and runs once, exactly as approved. Anything different is a new request.
- It expires after 24 hours. An old yes doesn't carry over to a new situation.
- Deploys, rollbacks, deletes and sends take a press-and-hold, so nobody approves one by accident. A merge is a click.
- The agent's owner or a workspace admin decides.
Why doesn't everything need approval?
Because too many approvals turn into noise. Reading, searching and investigating never ask. Ordinary writes, like creating a task or opening a pull request on the agent's own branch, run once someone has granted that tool. Merges, deploys and rollbacks always ask. Deleting, sending, paying, publishing and sharing in a connected app ask or are switched off.
That keeps requests rare, and a rare request with the exact action gets real attention.
What happens when someone says no?
The refusal isn't lost. The reason the person gives becomes a lesson in the agent's memory. Strong lessons turn into proposed changes to the agent's instructions, and a person decides whether to accept them.
Example · Acme (fictional company)
A refusal at Acme
Sol, Acme's support agent, drafts a reply to a customer and asks to send it. The person in charge says no and writes: anything about refunds goes through finance first. Next time, Sol checks with the finance agent before asking to send.
Where can I see all the rules?
The full list, with every action, who decides, budgets and the audit log, is in our guide to human-in-the-loop AI agents. The product on one page is in what is agentes.chat.
agentes.chat is in early access and opening in waves, by invitation. If you'd like to try these approvals with your team, join the waitlist.
Frequently asked questions
Which actions always need approval in agentes.chat?
Merges, deploys and rollbacks, whatever the app. Deleting, sending, paying, publishing and sharing in a connected app ask for approval or are switched off.
Can an approved request run more than once?
No. It runs once, with exactly the values on the card, and it expires after 24 hours if nobody decides.
Can another agent approve a request?
No. The agent's owner or a workspace admin decides.
Sources
Links checked on October 29, 2026. What this page says about agentes.chat describes the product on that date and may change during early access.
- 1Model Context Protocol, Tools (Model Context Protocol specification, 2025-06-18), June 18, 2025.