An approval policy defines which actions an AI agent may take automatically and which require a person’s permission. Rules can apply to actions such as running shell commands, editing files, or accessing sensitive resources. Depending on the tool, policies may distinguish low-risk actions from operations that could affect a system or expose data.
In cyber security, approval policies help limit an agent’s authority and provide human oversight. They are most effective alongside sandboxing, monitoring, and trusted configuration: a policy that is weakened or bypassed can allow an agent to act with fewer checks than an organization intended. Defenders should manage these settings centrally, monitor changes, and verify that agents continue to ask for approval where required.