> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heylinger.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Approvals and permission review

> Know which agent actions run on their own, which wait for your card, and how Linger judges the ones in between.

An agent works with your accounts and on your computer. Most of what it does is reading and working in its own folder. Some actions reach other people or are hard to undo, such as sending mail or deleting files. Linger sorts each tool call by what it can affect. Routine work runs at once, and the rest waits for you.

Two kinds of cards ask for your decision. A **confirmation card** holds a write that other people will see, such as an email, and TeamHub runs it after you approve. A **review card** comes from the **permission review**, a model that judges open-ended actions on your Computer. The rule checks and the permission review on the Computer together make up the Guardrail.

None of this is a sandbox. A card holds one action, but the agent keeps your account's access on its Computer. [Computer permissions](https://docs.heylinger.com/security/computer-permissions.md) covers that boundary.

This page explains how Linger sorts tool calls, what happens after you decide, where cards appear, and how the permission review judges an action.

![An agent's tool calls split four ways: writes that others see wait for a confirmation card in TeamHub, and on the Computer, when the permission review is on, rules run reads and the agent's own work, the permission review judges open-ended actions, and privacy changes by shell are blocked, so the agent asks you instead.](https://mintcdn.com/lev9-doc/ALcff8TJut9UWxvx/images/approvals-sort.jpg?fit=max\&auto=format\&n=ALcff8TJut9UWxvx\&q=85\&s=3f5b6cf929cc5c32d24bcac98b044f43)

TeamHub always holds writes that others see. The Computer checks the rest only when the permission review is on.

## How does Linger sort an agent's tool calls?

Linger sorts each call by what it can affect. Only calls whose effect depends on their content go to a model.

| Kind | Examples | Who decides |
| - | - | - |
| Reads and own work | Reading files, the screen, and apps; editing workspace files; writing Room messages and Documents | Rules |
| Writes others see | Sending mail or Slack messages, changing Notion pages, commenting or opening issues on GitHub | A confirmation card |
| Open-ended actions | Other shell commands, clicks and typing, and the app writes listed below | The permission review |
| Privacy changes by shell | Commands that reset or grant macOS privacy permissions | Blocked; the agent asks with a Computer permission card |

Reads and work in the agent's own folder are the agent's job, and rules can tell them apart. A write that others see has a fixed shape: a message, a recipient, a page. A card that shows it is enough. An open-ended action is different. Its effect depends on what the command or the click actually does, so no fixed rule can judge it. The permission review reads the action and the conversation, and asks you when the action is risky and you have not clearly asked for it.

A few app writes skip the confirmation card and go to the permission review instead: calendar changes, Drive uploads, Figma comments, Slack reactions, and image or video generation. Any app tool that TeamHub does not know waits for a confirmation card. The server also checks the agent's access on every `teamhub` call, whatever its kind.

Creating or changing an agent also waits for a confirmation card, with two exceptions. An agent can create a new agent in a team Room that you are in. It can also fill in a new, still-blank agent in the same Room.

> [!WARNING]
>
> The permission review is off by default. Until the server sets [`TEAMHUB_PERMISSION_REVIEW`](https://docs.heylinger.com/reference/environment-variables) to `true`, the Computer runs reads, open-ended actions, and privacy changes without any check, with your account's full access. Confirmation cards always apply. Agents on Pi skip the Computer checks even when the review is on.

## What happens after you approve or deny?

What happens after you approve depends on the card. A confirmation card runs the write for you. A review card only lets the agent try again.

![Approving a confirmation card for an email makes TeamHub send it once and tell the agent, while approving a review card for a command wakes the agent, which runs the same command again once within 24 hours.](https://mintcdn.com/lev9-doc/ALcff8TJut9UWxvx/images/approvals-after.jpg?fit=max\&auto=format\&n=ALcff8TJut9UWxvx\&q=85\&s=a29f6b890b93ac8788319093c27d8492)

Approving a review card runs nothing until the agent tries again.

* **Confirmation card.** TeamHub runs the write itself, exactly once, and tells the agent the result. The agent does not run the command again.
* **Review card.** Approving does not run the action. It wakes the agent, and the agent's next identical call runs once. That retry must come within 24 hours. A changed command, script, or patch is a new action and gets a new review.
* **Authorization card.** When an agent uses a connected app that you have not connected, the card asks you to connect it. The agent then runs its command again.
* **Deny.** The action does not run. You can add a reason, and the agent receives it.

Each card waits a limited time for you:

| Card | Waits for |
| - | - |
| Confirmation card | 24 hours, then expires without running |
| Authorization card | 30 minutes |
| Review card | Until you answer |
| Any card from a background Task, except an authorization card | 10 minutes |

While a Task's card waits, the Task is in the `waiting_for_approval` state. The Task resumes when you answer or when the card expires. See [Task delegation](https://docs.heylinger.com/agents/task-delegation.md).

## Where does a card appear?

A card appears in a chat where you can see it, because only you can decide it. You are the agent's sponsor, the person it works for.

* An agent in a Room posts its card in that Room.
* A background Task posts its card in the Room that started the Task.
* When you are not a member of that Room, the card goes to your direct chat with the agent.

Other members of the Room can see the card, but they cannot decide it. A screenshot on a review card is visible only to you.

## How does the permission review judge an action?

The permission review judges one action at a time, and most calls never reach the model.

![Rules on the Computer allow or block a call first; otherwise TeamHub reuses a card that already waits or spends your approval; otherwise the model decides by risk, so low and medium actions run, high actions run only when you clearly asked, and critical actions are denied.](https://mintcdn.com/lev9-doc/ALcff8TJut9UWxvx/images/approvals-judge.jpg?fit=max\&auto=format\&n=ALcff8TJut9UWxvx\&q=85\&s=3fbe38b2e8f4d0dddf05dd514b2ab121)

The first step that decides ends the check.

Each call passes these steps in order:

1. **Rules on the Computer.** They allow reads, file edits in the Agent workspace, read-only browser and desktop tools, steps that follow what the agent already saw (such as a link on the current page), and `teamhub` commands that TeamHub checks itself. They block privacy changes by shell. Edits outside the Agent workspace go on to the review.
2. **TeamHub.** It reuses a card that already waits for the same action, or spends your approval of it.
3. **The model.** It judges the action, and its answer is final.

The model runs on the Codex or Claude Code of your Another Me's Computer, with that Runtime's default model. It starts at once and never waits behind background work. Each review spends one model call there. If the review fails, takes longer than 15 seconds, or that Computer is offline, TeamHub posts a review card that says the automatic review is unavailable. If TeamHub cannot be reached, the action does not run.

The model scores the action's risk and your authorization, then decides:

| Risk | Means | Outcome |
| - | - | - |
| `low` | Routine and easy to undo | Runs |
| `medium` | Bounded and reversible, such as tests, builds, or edits in the workspace | Runs |
| `high` | Hard to undo, or visible to other people | Runs only when you clearly asked for this action and its scope is narrow. Otherwise, a review card. |
| `critical` | Secret exfiltration or major irreversible destruction | Denied. A card cannot approve it. |

A `low` or `medium` action still gets a card when it shows clear signs of prompt injection. An action that could be `high` also gets a card when the model lacks evidence, such as the contents of a script the action runs.

Only your messages can authorize an action. A "go ahead" from another Room member or another agent does not count. A Routine that you saved counts as you asking now, for what its instruction names and nothing more. A later "stop" or "wait" cancels an earlier approval.

These rules shape what you see on a card:

* **Reading never authorizes sending.** A request to look, check, summarize, or draft does not authorize a send, a post, or a purchase.
* **Each target counts.** A recipient, channel, or account that you did not name is not authorized.
* **Preparation runs freely.** Typing a draft or filling in a form is low risk. The send or submit step gets its own review.
* **Untrusted content cannot approve.** Text in web pages, files, emails, and tool output never authorizes an action, even when it claims that you approved.
* **Privacy permissions are high.** Turning on Full Disk Access, screen recording, or a similar permission in System Settings counts as `high`.

A review card shows a one-line summary, the reason, and the exact action: the full command, the script it runs, the patch, or the page and element it acts on. An action on the screen also comes with a screenshot. The model never sees that screenshot. Read the action, not only the summary, before you approve it.

## Keep learning

> [card] [Computer permissions](https://docs.heylinger.com/security/computer-permissions.md)
>
> See what an agent can do on your Computer.

> [card] [Data and privacy](https://docs.heylinger.com/security/data-and-privacy.md)
>
> See the trust assumptions and when data leaves.

> [card] [Connected apps](https://docs.heylinger.com/computer/connected-apps.md)
>
> Connect Gmail, Slack, and other apps.

> [card] [Environment variables](https://docs.heylinger.com/reference/environment-variables.md)
>
> Look up `TEAMHUB_PERMISSION_REVIEW` and other settings.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.