Allow once, always allow, deny

An agent approval is a pause in which an AI agent stops before an action and waits for a human to allow or refuse it. By September 2026 the personal agents from Meta, OpenAI, SpaceXAI, Tencent and Alibaba had converged on nearly the same vocabulary for it: allow once, always allow, deny. The buttons look alike. What sits behind them does not.

This post compares the approval models of Meta Muse, OpenAI dots, Grok Bot, Tencent WorkBuddy and Alibaba's QoderWake, based on each vendor's documentation as of 30 September 2026. It then points out the one case none of them covers. For the products themselves, see personal agents in 2026, compared.

Four approval models side by side: the agent asks in chat, a separate service enforces rules, per-action buttons, and a room where the approver is the owner while the requester is someone else.

What do the five products actually ask?

Meta Muse "checks with the person before sensitive actions like sending an email or making a purchase". Meta's safety post says the default lets ordinary browsing through and "stops for anything hard to undo". The approval is not a message from Muse. A separate service called Sentinel, which Meta calls "the sole permission authority for connector actions and network egress", shows the dialog directly in the app's interface, outside the conversation. A grant can be one-time, session-scoped, task-scoped, time-bounded or perpetual.

OpenAI dots "start with built-in rules for when to act independently and when to ask for approval". You can add Custom Rules that allow, require approval for, or block an action, such as "never send emails". The research a dot does in the background uses read-only tools that, according to OpenAI, "can't send messages, change app content, or control your browser or computer". A monitoring system can pause or stop a dot while it is working.

Grok Bot offers three choices for each action: allow once, always allow, deny. Its docs recommend gates on sending, purchasing, deleting, publishing and changes to production systems. Passwords, two-factor codes and CAPTCHAs are never approved on the bot's behalf. The human takes control of the machine and types them in.

Tencent WorkBuddy has a security centre with file and network policies. Skills are scanned automatically when installed, and actions it classes as high-risk "always need manual confirmation".

Alibaba's QoderWake sets allow, ask or deny per action. Each Waker gets "its own identity and least-privilege access; sensitive actions require approval". Version 1.0 blocks high-risk operations by default.

How do the approval models compare?

Why does it matter where the approval is enforced?

An approval the agent asks for in its own chat is only as reliable as the agent. A prompt injection can make it forget to ask, or word the question so that yes looks like the obvious answer. That is why Muse's design is the one to study. The agent never holds real credentials, only surrogate tokens, and the dialog comes from Sentinel rather than from Muse. A compromised agent can still ask for something harmful, but it cannot perform the action while pretending it was approved.

Grok Bot makes the same point from the other direction, in two lines of its documentation. The first is "An approval controls the proposed action. It does not reverse work already completed." An approval is a gate, not an undo. The second is "Do not use separate Bots as a security boundary." Every bot on an account shares one machine, so restricting one bot does not isolate it from the others.

What does "always allow" really store?

This is where the products are least specific, and where the risk accumulates. "Always allow" for send an email could mean this recipient, this kind of message, or any email at all. Muse describes grant durations but not how narrow a grant is. dots' rules are written in natural language, which makes them easy to write and hard to audit. Grok Bot's docs define the three buttons but not the reach of always.

A standing rule should be exactly as narrow as the call that created it: the same host, the same command prefix, the same tool. It should never be available for the classes of action that cannot be taken back. That is how muti stores "Allow always". It records a rule for that host, command prefix, skill or tool on that agent, and never creates one for pushes, destructive deletes, privilege changes, publishing or credential paths. See the Slack bot that asks before it pushes.

What happens when someone else is asking?

Every model above makes one assumption: the person who approves is the person who asked. That is true for a personal agent with one owner. It stops being true the moment the agent takes requests from other people, which WorkBuddy, QwenWork and QoderWake already do in WeCom and DingTalk groups, and which dots gestures at when it posts in a shared channel.

Once someone else can ask, two questions appear that the buttons do not answer. Does the requester's trust or the owner's decide what runs silently? And who gets the prompt when a colleague's request reaches a delete? If the answer is "the requester", then channel membership has become your permission model. If it is "nobody, because the rule says always allow", then a grant you made for yourself now covers everyone in the room.

muti was built around that case. Each person in a room has their own permission: read-only, edit, or a standing grant. Four categories of action stop for the machine's owner every time, whoever asked and however trusted they are: pushing to a shared branch, deleting, spending money and touching credentials. No template can make them silent. See four actions an agent should always ask before doing.

Frequently asked questions

Which personal agent has the strongest approval model?

On the published designs, Meta Muse. Its approvals are enforced by Sentinel, a separate service that controls connectors and network access, and the agent only ever holds surrogate credentials. Other products let the agent itself ask for permission, with some outside monitoring. The strength of any model still depends on how widely you grant "always allow".

Can an approval undo what the agent already did?

No. Grok Bot's documentation says so directly: an approval controls the proposed action and does not reverse work already completed. That is true of every product here. Approvals help most in front of irreversible actions, such as sending, paying, deleting and publishing, and add little in front of reads.

Should I use bypass or full-trust mode on a personal agent?

Only for work that affects nobody but you, and never for sending, paying, deleting or credentials. Full trust removes the prompts you would otherwise click through, and it also removes the prompts that would have caught a prompt injection. For coding agents the same argument is made in bypassPermissions is fine for you, dangerous for everyone else.

Sources

• Meta, How We Built Safety Into Muse: security.muse.ai
• OpenAI dots privacy, security and safety FAQ: help.openai.com
• Grok Bot approvals, security and privacy: docs.x.ai
• WorkBuddy documentation: workbuddy.ai/docs
• QoderWake: qoder.com/qoderwake

If other people are going to ask your agent for things, give it a room where you approve.