Tools and approvals
The approval gate is the core safety rule in PP Agent: nothing that writes a file or changes a business system happens silently.
Two groups of tools
Section titled “Two groups of tools”- Read-only actions run freely: reading a document, searching the web, checking a dashboard, or listing files.
- Actions with consequences ask first by default: saving or editing a file, running a shell command, and changing data in a connected system.
Four policies per tool
Section titled “Four policies per tool”Open Settings › Tools (or an agent’s settings) to set each tool to:
| Policy | Behavior |
|---|---|
| Automatic | Runs without asking when the agent decides it is needed |
| Always ask | Shows the proposed call and waits for approval |
| Always allow | Runs without asking, as a standing permission |
| Off | The tool is not available to the agent |
Shell commands are off by default
Section titled “Shell commands are off by default”Shell commands can be set to run without asking, after a confirmation, or with a standing warning in Settings. Turning them on is a deliberate choice; a mistakenly approved command can delete files or change system state.
/yolo, or the matching switch in Settings › Tools, skips the approval step for everything
that is already allowed. It does not turn on tools that are off, and it does not widen an
agent’s tool list.
Scheduled and headless runs
Section titled “Scheduled and headless runs”When a scheduled task runs, nobody is present to approve an action. Actions that need approval are skipped for that run and reported in the saved conversation. Configure the tools a scheduled task needs ahead of time.
The same rule applies to a Telegram or Zalo run when the paired account is not answering the approval prompt.
Computer use
Section titled “Computer use”On macOS and Windows the agent can use desktop apps. Looking is free; clicking and typing ask first. PP Agent itself, terminals, and password settings are always off limits.
A practical policy
Section titled “A practical policy”- Start with the defaults and watch what the agent asks for.
- Allow read-only tools your team uses every day.
- Keep writes as Ask for agents that touch important files.
- Keep shell commands Off unless an agent genuinely needs them.
- Review policies when you import or receive an agent.
Related: MCP servers, Security and privacy.