An approval is the product. Everything else exists so this moment works.

What one looks like

The agent stops. A card appears on your Home tab, on your lock screen, and on your watch. It names the action, shows the command or the change, and marks how risky it is. You tap Approve or Deny.

The agent is blocked while it waits. There is no timeout that turns into a yes.

Every decision is written to the audit log, with who decided and when.

The three risk levels

Operator sorts actions into three bands, and you will see the words in the app.

Level	Means
Safe	Reading, listing, looking. Usually auto approved.
Caution	Writes, installs, network calls. The default is to ask.
Critical	Deleting, force pushing, spending money, anything hard to undo. Always asks, and can require Face ID.

What actually gets gated, and what does not

This is the part worth reading twice, because the honest answer is more useful than a slogan.

Gated: your own agent sessions, through Tag. If you run Claude Code in a terminal yourself, Operator can adopt that session. Its tool calls then come to your phone for approval before they run. This is the case where approvals cover essentially everything the agent tries to do.

Gated: workflow steps. Jobs and automations declare which steps need a person. Sending an email, publishing, spending, deleting: those are gates the job itself carries, and they ask.

Not gated: an agent inside its own sandbox. When a worker runs in a container on your Mac, it has a folder, a network, and nothing else. It cannot touch the rest of your machine. Asking you to approve each file write inside a box that exists precisely so it can be written in would be noise that trains you to tap yes without reading.

So the rule is: the sandbox is the boundary, and approvals guard the places where work leaves it. Operator does not claim to approve every action an agent takes, and any product that does is either lying or unusable.

Changing what asks

On the Mac, open the policy screen. Rules map an action to one of four outcomes:

• Auto approve. Never asks. Still logged.
• Ask. The default for anything with consequences.
• Ask with Face ID. For the ones you want to be sure a person did.
• Auto reject. Never allowed, never asked. Useful for a thing you know you never want.

Start loose and tighten. A policy that asks about everything gets ignored within a day, which is worse than a policy that asks about six things you actually care about.

Approving from the watch

The watch is the fastest surface. The card is short by design: what, how risky, yes or no. If you need the detail, the phone has it.

When you are not there

Nothing happens. The agent waits, the job stays open, and the approval is on Home when you come back. Work does not silently proceed because you were asleep, and it does not fail because you were asleep either.

If the queue has more than one waiting, Home shows one card and holds the rest behind it, with a count on the tab so you can see the real depth.