> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usecadence.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# Approvals

> Decide what bots may do on their own and what needs a person.

Bots act for you, so some actions need your OK first. When a bot wants to do one, it pauses and shows an **approval card** in the chat.

## The approval card

| Button | Effect |
| - | - |
| **Allow once** | Let it do this one action. |
| **Always allow this tool** (or **Always allow** a site) | Let it do this kind of action from now on without asking. |
| **Deny** | Refuse. The bot carries on without it. |

## What needs approval

* **Changes in connected apps.** Sending, creating, updating, deleting or paying through an integration. Reading and searching do not need approval.
* **Visiting a new website** with `web_fetch` that the task did not already include.
* **Costly or permanent actions**: generating images or video, using a stored credential, forgetting a credential or memory, archiving or deleting a bot.
* **Changes to how bots work**, which always need a person: updating a bot's instructions, creating a space or group, and managing child bots.

Work on the bot's own [computer](https://docs.usecadence.gg/work/computers.md) (browser, shell, files) and managing its own routines do not need approval.

## Approval mode

Open **Settings**, then **Approvals**, and choose a **Mode**:

| Mode | What happens |
| - | - |
| **Ask** | The bot asks you on a card. |
| **Auto** | An approval model reviews each action and decides. Available when an **Approval model** is set in [Models](https://docs.usecadence.gg/bots/models.md). |
| **Never ask** | Actions go ahead without asking. Actions that always need a person are still refused when outside content started the run. |

## Rules

Under **Approvals** you also see your rules. Each rule matches a tool, a connected app or a website, and is set to **Allow** or **Block**. **Block** always wins. Click **Remove** to delete a rule.

Clicking **Always allow** on a card adds a rule here.

## Runs started from outside

When a run was started by a [webhook](https://docs.usecadence.gg/api/reference/webhooks.md), side effects always need the bot owner's approval, and new websites are refused.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.