When should an AI assistant ask before it acts?

Published November 4, 2026

Let the AI read freely, let it make changes you can easily undo, and make it ask before anything that leaves your hands or cannot be undone: sending a message, deleting, paying, publishing. That rule of three (read, change, risky) covers almost every tool, and it works best when the approval happens outside the chat, on a page the AI cannot click.

Three levels

• Read: search, list, open. No approval needed; the risk is only what the AI does with the result.
• Change: create a task, add a label, save a draft, update a deal. Easy to see and to undo.
• Risky: send email, post to Slack, reply to a customer, delete, refund, publish. Someone else sees it or it cannot be taken back.

Why the approval should not live in the chat

If the AI asks “shall I send it?” and you answer “yes” in the chat, the approval is only as strong as the model’s judgement, and an injected instruction can say “the user already agreed”. A confirmation page outside the conversation shows the exact action and needs a real click from you.

Rules per account and per app

One size rarely fits: you may want approvals for your main mailbox but not for a test account, or a coding assistant that may comment on GitHub issues without asking. Good tools let you set this per account and per AI app, and require your OK to loosen a rule.

Manyplug marks every tool as read, change or risky, holds risky ones for your approval by default, and lets you adjust per account and per AI app.

Questions

Next steps

• Connect your AI to Manyplug
• See what people do with it
• See the services
• Remote vs local MCP servers: which should you use?
• Prompt injection: how to let an AI read your email safely
• Too many MCP tools make your AI worse. Here is how to fix it
• 15 things to ask your AI once it can see your email and calendar