When the assistant asks
Before some actions run, the assistant shows an approval card titled Action Approval Required on the web. It says what the action will do. Choose one of these:
- Confirm & Execute on the web. On the phone, the button names the action, such as Confirm Email or Approve and run. The action runs once.
- Cancel. Nothing runs.
If you wait too long, the card shows Action Expired (Action expired on the phone), and nothing runs.
Custom connector tools
Each tool of a custom connector has one of three settings:
- Asks first. The tool pauses for approval every time.
- Runs without asking.
- Off. The assistant cannot use the tool.
Owners and admins also see two shortcut buttons on the approval card:
- Always allow runs this tool now and stops asking for it in this workspace.
- Trust followed by the connector name runs this tool now and lets every tool the connector has today run without asking. Tools you turned off stay off. Tools the connector adds later still ask. On the phone, the button reads Trust server when the name is not shown.
Members do not see these two buttons. Only the owner and admins decide which tools ask first.
Built-in services
These actions ask you first by default:
- Gmail: sending, saving a draft, scheduling, and changing a message, label or draft.
- Google Sheets: deleting, clearing or moving a worksheet, and find and replace.
- Google Docs: find and replace across a document.
- Notion: creating a page, changing page properties, appending content, and adding a database row.
- Slack: sending files. Text messages are sent right away.
- Google Apps Script: running a function.
To change this on the web, select Settings from the account menu, open AI & Chat, and find Action confirmations. All unsafe actions is set to Always ask by default. You can switch it to Don't ask. A tool that has its own rule is listed under it, where you can change the rule or return the tool to Use default. On the phone, a built-in approval card also has a Settings button that changes how that tool asks. Access checks and provider permissions still apply either way.