# Approvals

> Risky steps wait for your Approve. See what asks, how to approve or reject on the Approvals screen, your standing approval rules, and how auto-approve works.

Your assistants ask before they do anything that is hard to undo or that people outside your company can see. You answer with **Approve** or **Reject**. Nothing in this category runs until you decide, unless you have turned on auto-approve for that kind of step.

## What asks and what does not

| Step | Asks you? |
| --- | --- |
| Opening a pull request | Yes |
| Pushing a branch or changing code on your repository | Yes |
| Opening an issue | Yes |
| Sending mail | Yes |
| Creating a calendar event | Yes |
| Charging a customer | Yes |
| Spending your money: ads, boosting a post, payments, subscriptions, paid media | Yes, always, with no switch to turn off |
| Registering a domain | Yes |
| Changing DNS records or nameservers | Yes |
| Deploying to production | Never, until you change the default rule. Then yes, unless you turn on auto-approve for production actions |
| Posting on social media | Never, until you change the default rule. Then yes |
| Deleting, closing, or removing something in a connected service | Yes, unless you turn on auto-approve for deletions |
| Reading, searching, or listing | No |
| Reviewing a pull request or checking CI | No |
| Drafts that are not sent | No |
| The Coder editing files in its own workspace | No |

> [!IMPORTANT]
> Your money always asks. An assistant never spends it without your Approve, even if you turned on auto-approve for other steps, even from a routine, and no house rule changes that. The request says plainly that it spends your money and shows what it will pay, so you can decide.

> [!NOTE]
> Mail, calendar, payment, and domain steps depend on integrations that are Coming soon. The rule is the same for them: sends, deploys, charges, publishes, creates, and domain registrations always wait for you.

## Where you answer

1. Answer in the chat where the request came from. A step that waits sits in the answer, right at the step that asks, with **Approve** and **Reject**. If notifications are on, the bell tells you when one waits and takes you there.
2. Or open [Approvals](https://stellarfirm.ai/app/approvals). It lists everything waiting, across all your chats. You find it in Settings, under Elsewhere in StellarFirm, and you can pin it to the sidebar from there.
3. Read what the request says, then choose one.

| Choice | What happens |
| --- | --- |
| **Approve** | The assistant carries out that step, and only that step. |
| **Reject** | The step is cancelled and nothing is sent, pushed, or created. |

The job stays open while it waits. You do not have to answer right away.

## What a request shows

Each request says what the assistant wants to do and where. For a pull request, that is the repository and the work it is about to publish. You can also open the job in [Jobs](https://stellarfirm.ai/app/jobs) to read the Coder's changes before you decide.

A request to register a domain names the registrar, what it charges now and for each renewal year, and the registrant contact that will be used. To use other registrant details for that one domain, reply with them before you approve; the assistant posts a new request. A request to change DNS lists every record or nameserver it will set.

## Your approval rules

Your approval rules are standing instructions that stay until you change them. Each one is either:

- **Ask me first**: "Ask before the Coder runs a command on its computer." The step waits for your Approve.
- **Never allow it**: "Never let any assistant ship to production." The step does not happen at all, and there is nothing to approve. The assistant tells you what it would have done.

You start with two rules, marked Default:

- Never let any assistant ship to production.
- Never let any assistant post on social media.

Change them on [Approvals](https://stellarfirm.ai/app/approvals) whenever you like. **Ask me instead** turns a never rule into an ask, **Never allow** does the opposite, and **Remove** drops a rule. StellarFirm asks you to confirm before a change that lets more happen. If you remove a default, **Add the defaults back** brings it back. Add your own rules for any assistant, for any kind of step, and only when a step mentions words you choose.

StellarFirm also learns from what you approve and reject. When you keep rejecting the same kind of step from one assistant, it suggests a never rule. When you always approve the steps one of your ask rules holds, it suggests removing that rule. A suggestion changes nothing until you take it, and **Dismiss** drops it for good. StellarFirm never approves a step or changes a rule on its own.

No auto-approve switch lifts a rule.

## Auto-approve

Auto-approve is your switch, and only you can turn it on. Every category starts off.

1. Open [Settings](https://stellarfirm.ai/app/settings) and go to **Auto-approve**. The same switches sit at the bottom of the Approvals screen.
2. Turn on a category. StellarFirm asks you to confirm, in plain words, and warns that the assistant may do something unexpected.
3. Choose the **Yes** answer to turn it on, or **No, keep asking me** to leave it off.

With a category on, the assistant does that kind of step without asking and tells you afterwards in the same chat. Turning it off takes effect straight away.

| Category | What it covers |
| --- | --- |
| Production actions | Shipping to production. |
| Deletions | Deleting or closing things in a connected service. |

> [!IMPORTANT]
> Steps that reach other people, such as pull requests, issues, mail, events, and charges, always ask today, and so do registering a domain and changing its DNS. So does anything that spends your money. There is no switch for them.

Auto-approve also never covers a step that needs your Approve for some other reason.

## Routines and loops

A [routine or a loop](/docs/ceo/routines-and-loops) never skips an Approve. Anything it sends, publishes, creates, or spends waits for you on every run, exactly as if you had typed the message yourself. A loop does not start its next run while the last one is still waiting for you.

## Auto-approve and house rules

Auto-approve is the "what you allow without asking" half of your [house rules](/docs/ceo/house-rules). The other half is the rules you write in your company brief. Together they decide what the assistants do after the work.

## Prompts to try

```prompt title="See what is waiting"
CEO, list everything waiting for my approval, with one line on what each step will do.
```

```prompt title="Explain a request"
CEO, explain the approval request for [job] in plain words: what will happen if I approve it, and what happens if I reject it?
```

```prompt title="Set a standing rule"
CEO, I never want [assistant] to [kind of step] without asking me first. Which approval rule should I add?
```

```prompt title="Check what asks"
CEO, remind me which kinds of steps ask for my approval and which ones do not, given my current settings.
```

## Next

- [House rules](/docs/ceo/house-rules)
- [Approvals and control](/docs/trust/approvals-and-control)
- [Your first goal](/docs/getting-started/first-goal)

---

Source: https://stellarfirm.ai/docs/ceo/approvals