> ## Documentation Index
> Fetch the complete documentation index at: https://help.casaconect.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Permission levels

> Decide how much the agent may do before it checks with you: ask for approval, let a safety review approve for you, or grant full access.

A **permission level** decides what happens when the agent is about to do something. It never changes what the agent is *able* to do. The same [tools](/agent/tools) are available at every level. What changes is who gives the go-ahead.

## The three levels

<CardGroup cols={3}>
  <Card title="Ask for approval" icon="hand">
    *The agent asks before reading, editing or sending anything.*

    Every action that touches your data pauses for your approval.
  </Card>

  <Card title="Approve for me" icon="shield-check">
    *A safety review screens sensitive actions and only asks you about the ones it holds back.*

    **The default.** Reading and tracked edits run. Sensitive actions are reviewed first.
  </Card>

  <Card title="Full access" icon="zap">
    *The agent skips permission prompts and the safety review.*

    Built-in checkpoints, like plan approval and sharing outside the organization, still ask.
  </Card>
</CardGroup>

### What each level does, by risk tier

Every tool has a [risk tier](/agent/tools#risk-tiers). This table is the whole rule.

| Tool tier                                             | Ask for approval      | Approve for me        | Full access           |
| :---------------------------------------------------- | :-------------------- | :-------------------- | :-------------------- |
| **Read** (search, read, list)                         | Asks you              | Runs                  | Runs                  |
| **Additive** (create, tracked edit, note)             | Asks you              | Runs                  | Runs                  |
| **Sensitive** (delete, update, send, browser)         | Asks you              | Safety review         | Runs                  |
| **Own checkpoint** (plans, Populate, sharing outside) | Its own approval step | Its own approval step | Its own approval step |

## The safety review

At **Approve for me**, each sensitive action is examined by a separate, fast AI reviewer before it runs. The reviewer decides one of three things:

| Verdict          | What happens                                                                                                                   |
| :--------------- | :----------------------------------------------------------------------------------------------------------------------------- |
| **Allow**        | The action runs. The result is marked *passed the safety review*.                                                              |
| **Ask the user** | You get a card titled **Held for your approval**, with the reviewer's reason                                                   |
| **Deny**         | The action does not run. The result is marked *held back by the safety review*, and the agent tells you what was held and why. |

<AccordionGroup>
  <Accordion title="What the reviewer looks at" icon="eye">
    The reviewer sees only four things: what *you* asked for, the exact action the agent wants to take, facts computed by the platform, and your organization's guidance.

    It deliberately does **not** see the agent's own reasoning or the contents of documents and emails the agent has read. That is where a malicious instruction would hide, so text planted in a document cannot talk the reviewer into approving something.
  </Accordion>

  <Accordion title="If the reviewer is unavailable" icon="circle-off">
    The action is held. A review that fails or times out never counts as an approval.
  </Accordion>

  <Accordion title="If several actions are held in a row" icon="repeat">
    After three consecutive refusals the agent stops and checks with you: *"Several actions in a row were held back, so the agent is checking with you."* This usually means the task needs a decision only you can make.
  </Accordion>

  <Accordion title="The agent does not work around a refusal" icon="ban">
    When an action is declined or held back, the agent is told not to retry it or reach the same result another way. It explains what was held and waits for you.
  </Accordion>

  <Accordion title="Cost" icon="coins">
    Reviews run on the fast, economical model and appear as their own line in your usage.
  </Accordion>
</AccordionGroup>

## Approving an action

When the agent needs your go-ahead you see a card: **The agent wants to do this**, describing the action in plain words.

| Button                          | Effect                                                                         |
| :------------------------------ | :----------------------------------------------------------------------------- |
| **Approve**                     | Run this action once                                                           |
| **Always allow in this thread** | Run it, and stop asking about this tool for the rest of the conversation       |
| **Decline**                     | Do not run it. The agent carries on without it, or asks what you would prefer. |

The outcome stays on the result, so the record is clear later: *approved by you*, *allowed for this thread*, *passed the safety review*, *declined by you*, or *held back by the safety review*.

## Where levels are set

<Tabs>
  <Tab title="Your own conversations">
    Choose your level in **Settings → Permissions**. It applies to conversations you start in the dashboard and in Word.

    Your choice is stored in your browser, per user. On a new device or browser you start at the default, **Approve for me**, until you change it.
  </Tab>

  <Tab title="Inbox and matters">
    Work that starts from email or runs on a matter often has nobody watching, so it follows an **organization** setting rather than a personal one. Admins set one level for the **Inbox** and one for **Matters** in **Settings → Permissions**.

    Two levels are offered here: **Approve for me** (the default) and **Full access**. *Ask for approval* is not offered, because an unattended run has nobody to ask on the spot. Anything that needs a person goes to the conversation's or the matter's timeline as a [question](/agent/questions-and-approvals).

    Only organization admins can change these.
  </Tab>
</Tabs>

## What always asks, at every level

Some checkpoints belong to the action itself and cannot be switched off:

* **Approving a plan** before the agent carries it out
* **Reviewing values** before [Populate](/workflows/populate) writes them
* **Sharing outside the organization**, such as creating or building a Shared Space that invites outside parties
* **Sending email to anyone outside your organization.** These are always [drafts for approval](/inbox/approvals).
* **Taking over a browser session**, when a site needs you to sign in
* **Proposed changes** to records from email

## Choosing a level

| If you…                                                                                              | Choose               |
| :--------------------------------------------------------------------------------------------------- | :------------------- |
| Are new to the agent, or working on something delicate                                               | **Ask for approval** |
| Want to work at full speed with a safety net                                                         | **Approve for me**   |
| Are doing bulk, low-risk work you will check afterwards, such as reorganizing your own drafts folder | **Full access**      |

<Tip>
  You do not have to choose once and for all. Stay on **Approve for me**, and use **Always allow in this thread** when a particular conversation involves many repeated actions of the same kind.
</Tip>

Whatever the level, remember the two protections beneath it: the agent can only reach what **you** can reach, and edits to existing documents are [tracked changes](/documents/tracked-changes) you can reject.