Lesson 5 6 min
Rules it cannot bypass
Rules decide what an agent does alone, asks about, or never does. They are enforced in code around every action.
Pick a preset
On the builder’s Rules tab, each action is allowed, asks first or is blocked. Start from a preset:
| Preset | What it means |
|---|---|
| Cautious | Asks before anything that changes a page |
| Balanced (default) | Browses alone, asks before submitting forms |
| Autonomous | Acts alone within the locked rules |
Then fine-tune per action: reading pages, navigating and clicking, typing into forms, submitting forms, using your own tabs, each workflow, web search, handing work to teammates and each MCP server. Add sites it may only use, or must never use; patterns like *.bank.* work. Clicks that commit something, such as Reserve, Book, Confirm, Send or Buy, count as submitting.
Approvals and receipts
When an agent asks, a card shows what it wants to do, exactly what will be sent (such as the recipient and subject of an email, with secrets masked) and which rule asked. Choose Allow once, Always on this site (or Always allow) or Deny; a denied action is skipped and the agent continues without it. Your answer leaves a receipt under the reply, such as Allowed once by you, with the time.
Locked actions
Some actions always need you, whatever the rules or the preset say, Autonomous included:
- Payments: the agent stops before payment and hands the step to you to finish.
- Passwords and sign-in, sending messages or posts as you, and deleting data always ask.
This is judged by what a tool really does, not its name: a workflow with a Gmail step set to Send always asks, even if it is called “Daily digest”.
Key takeaways
- Balanced, the default, browses alone and asks before submitting forms.
- Approval cards show exactly what will be sent, and leave a receipt.
- Payments, passwords and sign-in, sending as you and deleting data always need you.