# Approvals

Choose which AI agent actions need your OK before they run, and allow them once or always.

Your AI agent can tap and type freely, but actions that change your device or your Mac ask you first. You stay in charge without watching every step.

## 1. Actions that ask first

When **Ask Before Risky Agent Actions** is on, Device MCP asks before an agent:

* Installs an app
* Uninstalls an app
* Builds and runs your project ([Build & Run](build-and-run.md))
* Opens a link
* Downloads an app's data

## 2. Approve or deny

When an agent wants to do one of these, Device MCP plays a sound, bounces its Dock icon and shows **An agent wants to: …** with three choices:

| Choice | What it does |
| --- | --- |
| **Allow Once** | Runs this action this time only. |
| **Always Allow** | Runs this kind of action from now on, without asking. |
| **Deny** | Doesn't run it. Your agent is told you said no. |

{% hint style="info" %}
If you don't answer within 2 minutes, the action doesn't run.
{% endhint %}

## 3. Settings

Open **Device MCP → Settings → MCP** and find the **Safety** section:

* **Ask Before Risky Agent Actions**: turn approvals on or off. It's on by default.
* **Always allowed**: lists the actions you chose to always allow. Click **Reset** to be asked again.