Approve Pioneer AI actions

Pioneer AI looks things up on its own, but it does not change anything in your Outpost until a technician approves it. This page explains which actions ask, how to read and answer the approval card, and which actions Pioneer AI can never take, whatever your permissions.

Before you begin

• Pioneer AI acts with your permissions. Approving an action does not give it more than your role allows. A call your role does not allow is refused as it would be in the console.
• An approved action runs as you, and the audit log records it as yours.

Which actions ask

Every tool call has a tier, shown as a chip on its card:

Tier	What it covers	Approval
Read	Looking things up: endpoints, software, alerts, tickets, patches, scripts, documentation	None
Change	Routine changes: acknowledging alerts, creating and updating tickets, adding ticket messages, logging time, editing documentation and tags, moving endpoints to a site, refreshing inventory, scanning for patches	Yours, for every call
High impact	Everything else that changes something, including running commands and scripts, endpoint actions, wake, controlling a remote session’s screen, approving and applying patches, deploying software, device group membership, every delete, and changes to users, roles, profiles, and policy	Yours, for every call
Display	Opening a console page, and showing a table, a chart, or a launch card	None. A launch card connects only when you select it.

Shell commands are the exception: each one gets its tier from what it does. See Shell commands.

An owner can let a separate AI safety review approve Change, or Change and High impact, actions for people who opt in. See Turn on automatic approval.

Shell commands

When Pioneer AI works in a shell on an endpoint, the tier follows each command, not the tool:

• Opening a shell is Read. Nothing runs until a command is sent.

• Each command Pioneer AI sends, to its own shell or to a terminal tab of yours, is judged before it runs:

  Tier	Examples
  Read	Commands that only read, such as hostname, whoami, ipconfig /all, Get-Service, ls, or df
  Change	Commands that change the endpoint, such as Restart-Service Spooler
  High impact	Deleting files or formatting disks, adding or removing accounts and permissions, restarting or shutting down, changing security, firewall, or boot settings, and downloading and running code

• A command that chains others, such as with ;, &&, or > to a file, is never Read, and takes the tier of its riskiest part. Piping into a filter such as Select-Object or grep does not count as chaining.

• When Pioneer AI cannot judge a command, it treats it as a Change.

Known commands are judged by fixed rules. Anything else is judged by a short call to the AI model, which appears as Shell command checks in usage.

Read commands run without asking while Run read-only shell commands without asking is on. It is on by default. The reply then shows Ran without approval: read-only with the reason, for example Ran without approval: read-only (A known read-only command.). To approve every command, an owner turns the setting off. See Set up Pioneer AI. Read commands then ask like a Change.

The approval card for a shell command says why it asks, for example High impact: Matches a high-impact pattern (deletes, accounts, security, shutdown or remote code). The same verdict and reason appear on the command’s row in Actions in this conversation.

Automatic approval treats shell commands like other actions of the same tier, with one exception: a High impact command in one of your own terminal tabs always asks you.

This applies to Pioneer AI in the console. A connected app’s shell calls keep their fixed tiers. See MCP server.

Answer an approval card

When Pioneer AI wants to take an action, the reply shows a card headed Pioneer AI wants to take an action, with the tier chip.

1. Read what the card shows:

   Field	What it is
   Tool	The tool Pioneer AI wants to call.
   Request	The console operation it calls, when it is not a named tool.
   Clients	On the MSP plan, the clients the action touches.
   Targets	The endpoints or other items it acts on, with a count. For an action on many endpoints, such as a script run or a deployment, each line is the hostname and its client. The card lists the first 50, then says and a number more. Scroll the list to read it.
   Script and Runs in	The script and its version, and the interpreter.
   Exact command	The command exactly as it will run.
   Request body	What will be sent. Values whose names look like secrets show as (hidden).

2. Select Approve to run it, or Deny to refuse it.

The card then shows the outcome:

Outcome	Meaning
Approved.	You approved it, and Pioneer AI ran it.
Approved by the AI safety review.	Automatic approval approved it.
Denied. Nothing was run.	You denied it. Pioneer AI is told, and carries on without it.
This request expired before anyone decided. Nothing was run.	Nobody answered within 10 minutes.

An approval works once, for exactly the request shown. If Pioneer AI wants to do it again, or to do something slightly different, it asks again.

If you send a new message instead of answering, the waiting action is declined, nothing is run, and Pioneer AI answers your new message.

A card with a Sub-agent chip comes from a sub-agent and names the goal it is working on. You answer it the same way.

Undoing a high-impact change is a change of its own, so it shows an approval card too. See Undo an action.

If you leave before deciding

You can close the drawer, or the browser, while an approval card is waiting. The conversation keeps the request, and its last reply says Waiting for your decision above. Open the conversation from Your conversations, answer the card, and Pioneer AI continues from there. After 10 minutes the request expires and Pioneer AI has to ask again.

Approve from the approval page

A Pioneer AI approval can also be answered on the Approve an AI action page, the same page that AI apps connected with MCP send you to. The page names Pioneer AI as the app that asked. Only you can answer an approval for your own conversation. An owner reviewing your conversation sees Waiting for the technician to decide. and cannot answer it.

Actions that are never allowed

Some actions are refused for Pioneer AI whatever the person’s permissions, and are not offered to the model at all:

• Revealing secrets: vault credentials, their one-time codes and history, hidden fields in documentation, BitLocker and other recovery keys, and backup keys.
• Playing or downloading remote session recordings.
• Exports, such as documentation exports and the organization data export.
• Billing and payment changes, and recording payments on client invoices.
• Sign-in and account security: passwords, two-factor authentication, passkeys, invitations, sign-in restrictions, and the organization security policy.
• Its own governance: Pioneer AI settings, AI budgets, a client’s AI override, AI connections, and anyone’s automatic approval setting.
• Transferring files to or from an endpoint.

An action that asks you to confirm your second factor in the console, such as revealing backup keys, cannot be run by Pioneer AI. A second factor you confirmed in the console never counts for Pioneer AI.

Verify

Every Pioneer AI tool call, including refused ones, appears under Recent activity on Settings > AI, with Pioneer AI in the Via column, its tier, its outcome, and how it was confirmed. Viewing it needs ai:manage. Changes also appear in the audit log.

Next steps

• Turn on automatic approval
• Pioneer AI data and privacy