How your agents ask before they act
Last updated 30 September 2026
Each agent touches only what you hand it
An agent's code runs in a sandbox on your account's computer. It can change only its own folder, read the rest of your files, and use only its own browser window. It never sees your logins, your other agents' files or the keys that hold the computer together.
Passwords and keys you give it are sealed: used only after you tap, typed only into a password field, never shown again and never in a log. You pick the model each agent thinks with, and a monthly cap stops it where you say.
Reading just happens, changes ask first
Your agents do two kinds of things. They read: search the web, open a page, check your email. And they change things: send, post, book, delete or pay.
Reading leaves everything as it was, so by default it doesn't ask. A change waits for you, unless you've said it can go ahead.
Two areas, two settings
In Settings → Permissions, each area has two settings: Ask for some actions, the default, and Always ask.
Apps and web covers the apps you connect and the browser. Computer covers your agents' commands, and their mouse and keyboard on its screen.
| Area | Ask for some actions (default) | Always ask |
|---|---|---|
| Apps and web | Asks before an app sends, posts or deletes, or a page sends, publishes, deletes or buys. Also before opening an unfamiliar site the agent typed in itself. | Asks before everything an app does, reading too, and before every new site in a task. |
| Computer | Commands in the sandbox, and clicks and typing in the agent's own browser window, just run. A new website, or leaving the sandbox, asks once. | Asks before every command. |
A few things always ask
These ask every time, whatever your settings:
- Buying anything. It's only ever Allow once, and Criw never types a card number.
- Using a saved password or key.
- Using the mouse and keyboard on anything but its own browser window: your windows, a terminal, another app. In its own window, an agent just clicks and types.
Always allow is never offered for these.
How Criw knows a click is a purchase
A page doesn't label the button that spends your money, so when an agent clicks, Criw holds the request and looks at three things:
- The request: whether it places an order, checks out or pays.
- The button: its words, like Pay or Place order, in any language.
- The page: whether it has a card field or a payment form.
If that doesn't settle it, a quick check decides from those three facts alone, never from the page's text. If it still can't tell, it asks.
A purchase waits where it is until you answer.
Your agents' code runs in a sandbox
Agents run code in a sandbox on their own computer. It can change only its own folder, and it can't see your logins.
Packages from npm, PyPI or GitHub just download. Any other website asks the first time.
A job that needs more asks to run outside the sandbox, and shows you the exact command.
Your own terminal, and your own hands on the Screen, never ask.
You decide how far a yes goes
When an agent asks, a card in the conversation says what will happen, like Place an order on renfe.com. Then you choose:
- Allow once: just this action.
- Allow for this task: this kind of action, until the task is done. Not for buying.
- Allow on this site or Always allow: a saved rule. Not for what always asks.
- Deny: it doesn't happen, and the agent is told.
If you pick Allow once for the same thing often, the card offers a saved rule first.
See what went ahead, and fine-tune it
Settings → Permissions → Activity shows what went ahead without asking, and why. Stop allowing this removes the rule that allowed it.
Manage has the finer controls:
- Connectors: each app's tools set to Ask, Allow or Off.
- Routines: Ask before anything, for routines that run while you're away.
- Allowed websites and allowed commands: your saved rules, each with Remove.
- Custom rules: your own, for any agent and any action.
You can always stop
Stop ends a run at once, and a spending cap on each agent and routine keeps costs where you set them.
Before a run's first command outside the sandbox, Criw saves a copy of the computer. Undo this run's changes to the computer puts it back.
A sent email or a payment can't be undone. That's why they ask first.
You're responsible
Your agents act for you, and you're responsible for what they do, as the Terms of service say.