---
title: "Approve Pioneer AI actions"
description: "How Pioneer AI asks before it changes anything, what the approval card shows, and which actions it can never take."
url: "https://support.outpostplatform.com/pioneer-ai/approve-actions/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Pioneer AI tool tiers: Read runs without asking; Change and High impact wait for an approval card showing the tool, targets, and exact command. An approval works once and expires after 10 minutes. Shell commands are tiered per command; read-only ones run without asking unless an owner turns that off. Lists never-allowed actions and where calls are logged."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "ai:use"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/pioneer-ai/approve-actions.md"
license: "CC BY 4.0"
---

# Approve Pioneer AI actions

Pioneer AI looks things up on its own, but it does not change anything in
your Outpost until a technician approves it. This page explains which actions
ask, how to read and answer the approval card, and which actions Pioneer AI
can never take, whatever your permissions.

## Before you begin

- Pioneer AI acts with your permissions. Approving an action does not give it
  more than your role allows. A call your role does not allow is refused as it
  would be in the console.
- An approved action runs as you, and the [audit log](/depot/audit-log/)
  records it as yours.

## Which actions ask

Every tool call has a tier, shown as a chip on its card:

| Tier | What it covers | Approval |
| --- | --- | --- |
| **Read** | Looking things up: endpoints, software, alerts, tickets, patches, scripts, documentation | None |
| **Change** | Routine changes: acknowledging alerts, creating and updating tickets, adding ticket messages, logging time, editing documentation and tags, moving endpoints to a site, refreshing inventory, scanning for patches | Yours, for every call |
| **High impact** | Everything else that changes something, including running commands and scripts, endpoint actions, wake, controlling a remote session's screen, approving and applying patches, deploying software, device group membership, every delete, and changes to users, roles, profiles, and policy | Yours, for every call |
| **Display** | Opening a console page, and showing a table, a chart, or a launch card | None. A launch card connects only when you select it. |

Shell commands are the exception: each one gets its tier from what it does.
See [Shell commands](#shell-commands).

An owner can let a separate AI safety review approve **Change**, or **Change**
and **High impact**, actions for people who opt in. See
[Turn on automatic approval](/pioneer-ai/automatic-approval/).

## Shell commands {#shell-commands}

When Pioneer AI works in a shell on an endpoint, the tier follows each
command, not the tool:

- **Opening a shell** is **Read**. Nothing runs until a command is sent.
- **Each command** Pioneer AI sends, to its own shell or to a
  [terminal tab of yours](/remote-access/terminal/#pioneer-ai), is judged
  before it runs:

  | Tier | Examples |
  | --- | --- |
  | **Read** | Commands that only read, such as `hostname`, `whoami`, `ipconfig /all`, `Get-Service`, `ls`, or `df` |
  | **Change** | Commands that change the endpoint, such as `Restart-Service Spooler` |
  | **High impact** | Deleting files or formatting disks, adding or removing accounts and permissions, restarting or shutting down, changing security, firewall, or boot settings, and downloading and running code |

- A command that chains others, such as with `;`, `&&`, or `>` to a file, is
  never **Read**, and takes the tier of its riskiest part. Piping into a
  filter such as `Select-Object` or `grep` does not count as chaining.
- When Pioneer AI cannot judge a command, it treats it as a **Change**.

Known commands are judged by fixed rules. Anything else is judged by a short
call to the AI model, which appears as **Shell command checks** in
[usage](/pioneer-ai/usage/).

**Read** commands run without asking while **Run read-only shell commands
without asking** is on. It is on by default. The reply then shows **Ran
without approval: read-only** with the reason, for example **Ran without
approval: read-only (A known read-only command.)**. To approve every command,
an owner turns the setting off. See
[Set up Pioneer AI](/pioneer-ai/set-up/#read-only-shell-commands). Read
commands then ask like a **Change**.

The approval card for a shell command says why it asks, for example
**High impact: Matches a high-impact pattern (deletes, accounts, security,
shutdown or remote code).** The same verdict and reason appear on the
command's row in **Actions in this conversation**.

Automatic approval treats shell commands like other actions of the same tier,
with one exception: a **High impact** command in one of your own terminal tabs
always asks you.

This applies to Pioneer AI in the console. A connected app's shell calls keep
their fixed tiers. See [MCP server](/pioneer-ai/mcp-server/).

## Answer an approval card

When Pioneer AI wants to take an action, the reply shows a card headed
**Pioneer AI wants to take an action**, with the tier chip.

1. Read what the card shows:

   | Field | What it is |
   | --- | --- |
   | **Tool** | The tool Pioneer AI wants to call. |
   | **Request** | The console operation it calls, when it is not a named tool. |
   | **Clients** | On the MSP plan, the clients the action touches. |
   | **Targets** | The endpoints or other items it acts on, with a count. For an action on many endpoints, such as a script run or a deployment, each line is the hostname and its client. The card lists the first 50, then says **and** a number **more**. Scroll the list to read it. |
   | **Script** and **Runs in** | The script and its version, and the interpreter. |
   | **Exact command** | The command exactly as it will run. |
   | **Request body** | What will be sent. Values whose names look like secrets show as **(hidden)**. |

2. Select **Approve** to run it, or **Deny** to refuse it.

The card then shows the outcome:

| Outcome | Meaning |
| --- | --- |
| **Approved.** | You approved it, and Pioneer AI ran it. |
| **Approved by the AI safety review.** | [Automatic approval](/pioneer-ai/automatic-approval/) approved it. |
| **Denied. Nothing was run.** | You denied it. Pioneer AI is told, and carries on without it. |
| **This request expired before anyone decided. Nothing was run.** | Nobody answered within 10 minutes. |

An approval works once, for exactly the request shown. If Pioneer AI wants to
do it again, or to do something slightly different, it asks again.

If you send a new message instead of answering, the waiting action is
declined, nothing is run, and Pioneer AI answers your new message.

A card with a **Sub-agent** chip comes from a
[sub-agent](/pioneer-ai/use-pioneer-ai/#sub-agents) and names the goal it is
working on. You answer it the same way.

Undoing a high-impact change is a change of its own, so it shows an approval
card too. See
[Undo an action](/pioneer-ai/use-pioneer-ai/#undo-an-action).

### If you leave before deciding

You can close the drawer, or the browser, while an approval card is waiting.
The conversation keeps the request, and its last reply says **Waiting for your
decision above.** Open the conversation from **Your conversations**, answer
the card, and Pioneer AI continues from there. After 10 minutes the request
expires and Pioneer AI has to ask again.

### Approve from the approval page

A Pioneer AI approval can also be answered on the **Approve an AI action**
page, the same page that [AI apps connected with MCP](/pioneer-ai/mcp-server/)
send you to. The page names **Pioneer AI** as the app that asked. Only you can
answer an approval for your own conversation. An owner reviewing your
conversation sees **Waiting for the technician to decide.** and cannot answer
it.

## Actions that are never allowed

Some actions are refused for Pioneer AI whatever the person's permissions, and
are not offered to the model at all:

- Revealing secrets: vault credentials, their one-time codes and history,
  hidden fields in documentation, BitLocker and other recovery keys, and
  backup keys.
- Playing or downloading remote session recordings.
- Exports, such as documentation exports and the organization data export.
- Billing and payment changes, and recording payments on client invoices.
- Sign-in and account security: passwords, two-factor authentication,
  passkeys, invitations, sign-in restrictions, and the organization security
  policy.
- Its own governance: Pioneer AI settings, AI budgets, a client's AI
  override, AI connections, and anyone's automatic approval setting.
- Transferring files to or from an endpoint.

An action that asks you to confirm your second factor in the console, such as
revealing backup keys, cannot be run by Pioneer AI. A second factor you
confirmed in the console never counts for Pioneer AI.

## Verify

Every Pioneer AI tool call, including refused ones, appears under **Recent
activity** on **Settings** > **AI**, with **Pioneer AI** in the **Via** column,
its tier, its outcome, and how it was confirmed. Viewing it needs `ai:manage`.
Changes also appear in the [audit log](/depot/audit-log/).

## Next steps

- [Turn on automatic approval](/pioneer-ai/automatic-approval/)
- [Pioneer AI data and privacy](/pioneer-ai/data-and-privacy/)