Green — runs unattended
Reaches nobody. Reversible or inconsequential. No approval, ever; it appears in the action log and that is the audit.
create_draftcreate_taskremembersummarizelog_measurementset_reminder
← Chitragupta
The final say
Let it work.
Let it work.
Keep the last word.
Reading is free. Anything that leaves your machine stops at a card with the real content, every field editable — and what runs is what is on the card when you press Confirm, never what the model first wrote.
The gate
Three tiers, declared per action
A binary gate cannot tell drafting an email from sending one, so it treats both as outbound and asks twice. Nine taps later you stop reading them, which is the failure mode that matters. Every action declares its own tier instead.
Amber — asks, and remembers the answer
Reaches a person, or changes somebody else's system. Approval required — but repeated approval of the same shape can become a standing grant.
send_emailsend_messagecreate_eventgithub_commentnotion_appendwrite_fileRed — always explicit, never promotable
No grant promotes these, and no unattended run may take them. However many times you have said yes before, it asks again.
delete_datasend_moneymake_purchasepublish_publiclymodify_account_settingsAn action cardA drafted reply with every field editable, and Confirm beneath it
A case that moved
The test is not “does it reach somebody”
Moving a meeting was predicted amber and shipped red. Creating an event is amber because its attendees are right there on the card — the machinery can see who it reaches. The people a move reaches are on the existing event, not in the parameters. Amber would have found no recipients, read that as “reaches nobody”, and let an unattended agent rearrange a diary full of other people's mornings.
The test is not does it reach somebody but can this tier's machinery see who.
Money
Buying something is its own problem
“Yes, act on this shop” is something a person can genuinely mean. “Yes, buy this basket at this total” is not something anyone can mean in advance — so acting on a site and placing an order are separated, even though both are clicks.
Filling a basket is a free click
Otherwise an agent needs a tap per bag of oats and nobody uses it twice.
The checkout control is recognised
Not by the model's word for it — by the name the page gave the control.
It becomes one card
Every item, and the shop's own total. Not the agent's arithmetic.
Re-checked at the moment you press Confirm
If the basket moved between the card being drawn and you tapping it, the order is refused rather than placed.
Unattended
While you are not watching
| rule | why |
|---|---|
| An unattended run can never touch a page | No site setting lifts that floor. |
| A target must be on the snapshot the model was shown | It cannot act on an element it inferred. |
| Mail triage never runs unattended | Its input is text strangers wrote. There is nothing safe to allow-list. |
| A routine pre-authorises the routine | Not the stranger who wrote the email it just read. Outbound needs a recipient on the explicit list — a derived list is exactly what an injection would name. |
An approval that waitedThe whole message shown, with Approve · Always allow · Dismiss
Want it on your Mac?
Free while it is in beta. Bring your own model — or run a local one and never leave the machine.
Join the waitlist→