Approvals, policy and Home.

Where approvals appear

In a chat, a tool call that needs your approval stops with Deny, Allow for session and Allow once. Checkpoints (submitting a plan, pushing, opening a pull request, delegating to another agent) are asked every time, with no Allow for session; only the agent’s autonomy level lifts them.

Asks from runs on a paired daemon also appear in the Now band on Home, with Deny and Allow once, or Approve for a plan, and the Home entry in the rail counts how many are waiting for you. An ask answered on another of your devices clears everywhere.

Always allow

After you allow the same tool five times, Corenel offers to always allow it, in this workspace or everywhere; Not now and Never are the other answers. Shell commands and checkpoints are never offered and never always-allowed.

Settings, Tools, Approvals lists the tools you always allow, each with Revoke, sets how many allows come before a suggestion (0 never suggests), and keeps a decision log. The rules and settings are stored in this browser. Unless you turn on Keep full arguments in the decision log, the log records only argument types, sizes and file paths, never the values.

On a paired daemon the question is Always allow on this machine? That rule covers runs a connected client started while one of your devices is connected; scheduled and triggered runs are unaffected.

The built-in policies

standardThe default

Reads run; file writes and commands ask. Saving or forgetting the agent’s own memory notes is the one write it allows.

read-only

Writes, commands and memory changes are refused outright.

autonomous

Everything runs without asking, except changes to Corenel’s own configuration.

Choose one from the Policy row of a chat’s options (the sliders button in the composer), where Edit policies… also writes your own. A crew agent carries its policy in its Tools and Policy sections. Any tool from an MCP server, and any call from an external agent that does not say what it does, is treated as one that changes things.

When nobody is watching

A crew agent’s Unattended mode decides what happens when a run on the daemon needs approval and nobody is attending. deny refuses the action and the run carries on without it; it is the default. park waits for someone to answer, up to 30 minutes or the run’s time limit if that is shorter, then denies. allow approves it. If a device is attending when the ask fires, it is offered the ask first.

The audit log

Every run appends to a local audit log, on by default (Settings, Tools, Approvals, Keep an audit log). It is append-only, holds no prompt or file content, and each line carries a hash of the one before it, so an edited or missing line breaks the chain. A failed write is recorded as a gap rather than lost silently. Files older than 180 days are removed. The browser keeps its log in the workspace’s state folder; the daemon keeps its own, switched in its config file.

Recordings

Separately, every agent and workflow run is recorded as it happens, tool calls and decisions included, and replays under Activity with a scrubber.

What Home shows

Now

What needs you (approvals waiting on the daemon) and what is running, including tasks. It needs a connected sidecar.

Pick up where you left off

Your recent chats.

Projects

Your projects.

What ran

Recent runs, as far back as you choose.

Crew

Your crew agents.

+ New task

Opens the New task form; see Tasks and the orchestrator.