# Approvals

> The gate in front of anything an agent cannot take back — what triggers it, what you see, and what happens when nobody is there to approve.

An **approval** is Endue stopping to ask before an agent does something irreversible. You see the exact action, with the exact arguments, before it happens.

## What triggers it

Every operation a [connector](/docs/connect/overview/) exposes is classified by what it does to the world. Two classes always stop for you:

| Class | Examples | Gated |
| --- | --- | --- |
| **Read** | Search email, list files, read a page, query a dashboard | No |
| **Write** | Create a document, add a row, draft an email, update a task | No |
| **Send** | Send an email, post to a channel, publish a post, reply to a comment, trigger a build | **Yes** |
| **Destructive** | Delete a file, delete a record, silence an alert | **Yes** |

The line is not "does it change something" but "can you undo it, and does it reach someone else". Creating a draft is a write. Sending it is a send.

<Aside type="caution" title="The gate is not configurable">
  Send and destructive operations always ask. There is no setting — per agent or
  per account — that turns this off. An agent that could disable its own gate
  would not be a gate.
</Aside>

## On devices

The agent's [devices](/docs/build/devices/) follow their own rule:

| Device | Asks first | Goes ahead |
| --- | --- | --- |
| **endue Computer** | Nothing | Reading and writing files in the [workspace](/docs/build/workspace/), running programs |
| **endue for Chrome** | Clicking, typing, pressing keys, filling forms, uploading files, closing tabs | Opening and reading pages, scrolling, taking screenshots |

The workspace is the agent's own folder on a device set up for it, so work there does not stop you on every call. A web page is different: a click can submit something that reaches someone else.

## Direct connections

Calls to a [direct connection](/docs/connect/direct-connections/), your own MCP server or HTTP API, are not classified, so **every call asks** by default. In the connection's settings you can turn on **Always allow** for a tool (MCP) or a method such as GET (HTTP). Routines and channels can use only what is always allowed.

## What you see and what happens

The run pauses and shows the operation and the arguments it is about to use — the recipient, the subject, the body, the file, the record.

**Approve** and the action runs with precisely what you saw. Approving is not a general permission; it authorizes that one action with those arguments.

**Reject** and the action does not happen. The agent is told, and it keeps working — it will usually adapt rather than stop, for example by proposing a different draft.

Editing before approving is not supported. If the arguments are wrong, reject, and say what should change — the agent will come back with a corrected action.

## Unattended runs

A [routine](/docs/automate/routines/), or any run nobody is watching, cannot ask. When an action in an unattended run needs approval, it is **refused** rather than left waiting.

That is deliberate: an action that silently waits for hours until someone notices it is worse than one that fails clearly. If a scheduled job needs to send something, expect it to produce a draft and tell you, rather than send on its own.

## Related gates

Two more things pause a run for your decision, and they work the same way:

- **A [skill](/docs/capabilities/skills/) the agent does not have.** It asks rather than failing; you grant or decline in the conversation.
- **A [question](/docs/work/questions/)** when it needs information only you have.

## Limits

- Approvals are answered in the conversation. The [Activity](/docs/work/activity/) board shows that one is waiting.
- You cannot edit the arguments at the gate — reject and redirect instead.
- Approval covers one action. The next send in the same run asks again.
- A rejected action cannot be replayed later; the agent must propose it again.

## Related

<CardGrid>
  <LinkCard
    title="Available connectors"
    href="/docs/connect/available-connectors/"
    description="Every connector, and how many of its operations are gated."
  />
  <LinkCard
    title="Routines"
    href="/docs/automate/routines/"
    description="Scheduling work, and what unattended runs will not do."
  />
  <LinkCard
    title="Security and permissions"
    href="/docs/account/security/"
    description="What an agent can reach, and what it cannot."
  />
</CardGrid>