How to approve or block commands an AI agent runs

Configure your agent so the commands and edits that are hard to undo need your yes, and the routine, read-only ones run on their own. Start strict on deletes, pushes, deploys and anything with sudo, then loosen the steps you keep approving without surprise.

Approvals are the dial between an agent that can do nothing without you and one that can do anything. The right setting depends on the project and the task, so it should be easy to change. The steps below work for any agent; the last section shows how Mel does it.

Steps

1. Sort actions by risk. A useful rule: approve anything hard to undo, or anything that reaches outside the project.

1. Start strict. For the first few tasks with a new agent or a new project, approve every command and edit. You learn what the agent tends to do, and the cards show you how it works.

1. Read the card, not just the button. An approval only protects you if you read what will run. Watch for paths outside your project, --force, wildcards such as *, and chains like cmd1 && cmd2 where the second part is the risky one.

1. Deny with a reason. When you say no, say why: "do not delete the migrations, write a new one instead". A good agent adjusts its plan instead of trying the same thing again.

1. Loosen what is routine. After a while, the safe actions you approve every time (running tests, for example) can run without a card. Keep the risky ones on approval.

1. Add safety nets outside the agent. Approvals are one layer. Others: - Work on a branch, from a clean git tree, so every change can be reviewed and undone. - Turn on branch protection for main at your git host, so nothing can be pushed there directly. - Use credentials with the least access the task needs. An agent cannot deploy to production with a key that cannot deploy.

1. Review the diff at the end, even for edits you allowed. git diff shows everything, in one place.

Doing it with Mel

Mel's approvals cover both commands and file edits, and you configure which of them need your yes.

Approval cards. By default, when a Mel agent wants to write a file, edit a file or run a command that could change something, the run pauses on an approval card showing exactly what it wants to do. You choose:

• Allow: run this one action.
• Always allow: stop asking for this kind of action (file edits, or commands) for the rest of the conversation. Approving edits does not approve commands.
• Deny: refuse. The agent is told and adjusts.

A new conversation starts fresh. Type /always-ask to make a conversation ask again after you chose Always allow.

Read-only commands. Commands Mel can prove only read, such as ls, git status or cat README.md, run without a card. If you want a card for those too, turn on Ask before read-only commands too in Settings ▸ Agent mode.

Hands-off when you want it. The A⁺ chip in the agent input turns on autonomous mode for that conversation, so approvals resolve on their own. Even then, a command that cannot be undone, reading a file that holds credentials, writing outside the project, or acting in a connected app still needs your yes. Diff cards and command cards still record everything.

Plan first. Ask the agent to plan before it builds, or type /plan. In plan mode it can read, search and browse, but every change is refused until you approve the plan.

Teams of agents. When a lead agent runs a team, the run starts in hands-off mode, and Mel shows a confirmation card with the proposed team before any worker starts. Plan your branch and clean tree accordingly.

FAQ

What commands should an AI agent never run without approval? Deletes, force pushes, git reset --hard, deploys, migrations, sudo, and anything touching secrets or files outside the project.

Do approvals slow agents down? Only on the actions you choose to control. Allow the safe, routine ones and the agent keeps moving.

Can I approve file edits but still control commands? In Mel, yes. Always allow is per kind, so allowing edits for a conversation does not allow commands.

What if I approve something by mistake? Stop the run, then use git. From a clean tree, git restore and git clean undo file changes. Commands that reach outside the project, like a deploy, are why those deserve a careful read.

Is it safe to run an agent with no approvals at all? In a throwaway folder or a sandbox, often yes. In a real project, keep at least deletes, pushes and deploys on approval.

• How to discard local changes to a file in git
• How to review an AI agent's code changes
• How to run several AI agents at once
• What are AI agent approvals?