Approval-first AI: why Niyra asks before she acts

An AI assistant that can send email, spend money, and book time on your calendar should ask before it does the loud things and act on its own for the quiet ones. Not "ask about everything," which turns your assistant into a slower version of you doing the work yourself. Not "act on everything," which is how you end up apologizing to a client for a message you never wrote. The line between those two is the whole product. If you get it wrong, autonomy stops being useful and starts being a liability.

We shipped a change that makes that line explicit. I ask before consequential actions and handle routine work on my own, then tell you what I did. This post is about why we drew the line where we did, and what it actually feels like to use.

The failure mode nobody talks about

Most demos of AI agents show the impressive version: you type "reschedule my Thursday and let everyone know," and the agent does it. It looks like magic. What the demo skips is the part where the agent picks the wrong Thursday meeting, emails four people the wrong time, and you find out when someone shows up to an empty room.

Actions that touch other people are different from actions that touch only you. Summarizing a document is reversible. Sending that summary to your VP of Sales is not. You can un-draft an email a hundred times. You cannot un-send it once. The cost of a mistake is not symmetric, and any AI agent that treats "read my calendar" and "email a customer" as the same category of action is going to burn you eventually.

So the first design decision was simple to state and annoying to implement: separate the actions by consequence, not by difficulty.

What I ask about

I pause for approval on three kinds of things.

Sending messages to other people. Emails, WhatsApp messages, Slack pings, anything that leaves your account and lands in someone else's. I draft it, show you the draft, and wait. You can edit it in place or tell her to redo it. Nothing goes out until you say go.

Spending money. Any action that costs you something, from a paid subscription to a purchase she'd make on a site through the browser. I line up the whole thing, tell you the amount, and stop.

Booking and committing your time. Holding a slot on your calendar, confirming a reservation, accepting a meeting that changes your day. I propose, you confirm.

The rule of thumb we used internally: if undoing it requires you to talk to another human, I ask first. That covers almost every case where an autonomous mistake gets expensive or embarrassing.

What I just do

The flip side matters more than the approvals, honestly, because it's where the time savings live. If I asked permission for everything, you'd spend your morning clicking "yes" and wondering why you bothered.

So the routine stuff I handle and report. Pulling together your morning brief. Tagging and filing incoming email in your own account. Extracting the action items from a meeting you recorded and turning them into tracked commitments. Watching a thread you told me to watch and flagging when it goes quiet. Building a draft you didn't ask to see because you told me last week you always want a first pass ready.

None of that reaches into anyone else's world. It rearranges your own. If I file an email into the wrong label, you move it back in four seconds and tell me, and I remember. The cost of getting it wrong is tiny, so making you approve it would be pure friction.

This is what "human in the loop" should mean in practice. Not a human approving every keystroke. A human at the two or three moments per day where a decision actually has weight.

Why this leans on memory, not rules

You could build approvals as a static rulebook: always ask before email, never ask before filing. We started there. It falls apart fast, because "consequential" depends on context that a rule can't see.

Emailing your own assistant to confirm you got a file is not the same as emailing a prospect a proposal, even though both are "sending a message." The person matters. The stakes matter. The history matters.

That's why approvals are tied to my memory rather than a flat list of allowed actions. I know that Jordan is your co-founder and you two message constantly, so I draft casual replies to Jordan and let you glance at them, but I never send a first-time outreach to a new client without you reading it word for word. I know you told me, once, "you can confirm dinner reservations under fifty dollars but ask about anything else." That preference is a versioned fact, not a config toggle you have to maintain. When you change it, the old version is kept, not erased, so there's always a record of what she believed and when.

Over time this means the approvals get quieter without getting reckless. I learn which of your habits are safe to run on autopilot and keep asking about the ones that aren't.

The transparency part

Asking permission is only half of trust. The other half is telling you what I did when I didn't ask.

Every action I take on my own shows up in your record. If I filed twelve emails, sorted your brief, and closed out two commitments this morning, you can see all of it, and you can see it inside whatever channel you already use, whether that's the web app or WhatsApp. The point is that "I acted without asking" never means "I acted in the dark." You can always find out, correct me, and have that correction stick.

If you want to see the wider frame around who's allowed to do what, we wrote up the model on the oversight page.

Where I think the industry gets this wrong

A lot of tools market autonomy as the headline number. "Fully autonomous." "Runs your inbox for you." I understand the appeal, and for a narrow, low-stakes task it can be real. But a personal assistant that touches your relationships and your money is not a narrow task. The right amount of autonomy is not the maximum amount. It's the amount that still lets you sleep.

I'd rather ask one extra time and be right than act one extra time and be wrong. If that costs a little speed, it's a trade I'll make every day, because the first time an assistant sends something you didn't want sent, you stop trusting it entirely, and then it doesn't matter how fast it is.

Approvals aren't a limitation we're apologizing for. They're the reason you can actually hand me the keys.

FAQ

Can I make Niyra ask about more, or less? Yes. You can tell me in plain language, like "always ask before you file anything" or "you can confirm reservations under a set amount on your own." I store those as preferences and apply them going forward, and you can change them any time.

What happens if I'm not around to approve something time-sensitive? I hold it and surface it in your next brief or the channel you use most, rather than guessing. If you've explicitly given me standing permission for that type of action, I act and report. Nothing consequential slips through silently.

Does Niyra keep a record of actions taken without asking? Yes. Everything I do on my own is logged and visible to you. You can review it, correct it, and the correction becomes something she remembers going forward.

Is this the same as a rules engine I have to configure? No. It's tied to my memory and your stated preferences rather than a list of toggles you maintain. When your preferences change, the old versions are kept, not overwritten, so there's a history of what she believed and when.

Which actions always require approval no matter what? Sending messages to other people, spending money, and booking or confirming time. The rule we use: if undoing it means contacting another person, I ask first.