# Approval rules

Decide which agent actions go ahead on their own and which wait for your OK.

Canonical page: https://themachine.myapps.ai/docs/code/approval-rules

By default, when an agent wants to do something that needs permission, a
card appears in the chat and waits for you. Approval rules let routine
actions go ahead on their own, so you only get asked about the ones that
matter.

Open **Settings › Approval rules** and turn on **Use approval rules**. With
it off, *every request waits for you.*

## Presets

Pick a **Preset**:

![The Preset menu with Safe, Balanced, and Ask everything](/images/docs/code/approval-presets.webp)

| Preset | What goes ahead on its own |
|---|---|
| **Safe** | *Reads and read-only commands go ahead; everything else asks.* |
| **Balanced** | *Also edits inside the workspace, web reads, tests and linters. Sends, deletes and other commands ask.* |
| **Ask everything** | *Nothing is approved for you. The guards still block the dangerous things.* |

## Fine-tune

![Approval rules settings with the Balanced preset and an answer for each kind of action, like Read files, Change files, and Run commands](/images/docs/code/approval-rules.webp)

| Section | What it does |
|---|---|
| **By kind of action** | Change the answer for one kind of action, like file edits or web reads. |
| **Always blocked** | Actions no agent may ever do, whatever else you set. |
| **Your rules** | Your own rules, for example always allow `npm test`. |
| **Try a command** | Type a command and see what the rules would do with it. |

Turn on **Also answer Machine cloud sessions** to apply the same rules to
your [Machine Cloud](/docs/code/machine-cloud) sessions while Machine Code is
open.

When an agent runs out of credits, a card in the chat tells you instead of
the agent failing quietly.