AI Agent Approval: What Personal AI Agents Can Do Without Asking You

Anthropic opened a research preview of Claude Duet on 21 October 2026 with a rule printed in the launch post: before it sends, pays, signs or deletes, it stops and waits for you. That makes seven personal agents that can act in your accounts while you sleep. They do not share one rule book.

Here is the problem in three sentences. A personal agent reads your inbox, holds your logins and can reach a checkout page. The promise behind all of them is that they only interrupt you when something matters. Whether that promise holds depends on what each vendor has actually written down, and three of the seven have written down very little.

This guide reads the vendors' own documentation, not their marketing, for Claude Duet, OpenAI dots, Meta Muse, Grok Bot, Poke, Perplexity Computer and OpenClaw. Where a vendor does not document a gate, we say so rather than guess. Everything below was read on 22 October 2026.

What changed this week: a written list of four actions

Most agent launches describe approvals in one soft sentence. xAI's Grok Bot launch post on 11 August said only that Bots come back "when something needs your approval." Duet's launch post is more specific. Anthropic says Duet "reads, drafts, and prepares work on its own", then names four actions that always wait for you: sending a message, making a payment, signing a document and deleting anything. For each one it shows exactly what it is about to do.

It goes one step further. A few actions are off-limits even with your approval: Anthropic names trading securities and moving money between accounts. That is a different kind of rule. An approval gate assumes you are the safeguard. A hard block assumes you might be tired, rushed or tricked, and removes the action anyway.

Duet can reach over 6,000 connectors and plugins in the Claude Marketplace, which is exactly why the list matters. Two other details matter for the skeptic. Duet checks your connected accounts every few hours rather than continuously, because constant checking would burn through your plan's usage limits faster. And Anthropic admits in the same post that this early version "might misread a thread or miscalibrate what's urgent." So the urgency judgment is openly unproven. The four-action list is the part that does not rely on it.

The approval gates, side by side

This table only records what each vendor documents itself. "Not documented" means we looked through the product page, help pages and docs and found no list.

The table under-sells two of them. OpenAI's dots carry three tiers, not one: actions that need approval every time, actions you can approve in advance (recurring messages, for example), and actions that never ask. OpenAI also says approving one message does not give the dot ongoing permission to contact people for you.

Grok Bot is the opposite design. xAI's approvals page, last updated 20 October, lists seven kinds of action you should fence off (sending messages, publishing, purchases and transfers, deleting data, changing permissions, production changes, accepting legal terms) but frames them as advice. You write the rules.

xAI's own approvals page frames these as boundaries for you to set, not defaults. Captured 22 Oct 2026.

Who this hits: anyone who assumed the defaults were strict

The gap in that table is not between good and bad products. It is between vendors who publish a fixed floor and vendors who hand you the controls.

That difference lands hardest on three kinds of user:

• Grok Bot users who never open Settings. Auto Review, in xAI's words, "is model-based and should complement, not replace, least privilege and explicit approval boundaries." The explicit boundaries are rules you add under Settings, General, Auto-review.
• Anyone running OpenClaw on its defaults. Its exec-approvals page says the exec.ask setting defaults to off, and host execution defaults to full on gateway and node hosts. Its security page adds that agents with the message tool "can send across conversations and channel providers by default."
• Poke and Perplexity Computer users who want a written promise. Neither vendor's help pages say which actions pause for approval, though Poke's Gmail integration can send mail and its plans run from free to $199 a month. That does not prove they never ask. It means you cannot check.

Teams get one advantage. Grok Bot lets a team admin lock Auto Review rules that members cannot edit, and personal rules "can only make behavior stricter." Perplexity's October changelog added role-based connector access for Enterprise admins, so a sensitive connector can be limited to admins or chosen roles.

Can an AI agent spend your money without asking? What each one bills and approves

This is the question most readers actually came with. On the documented record, none of the four big-lab agents is designed to finish a payment without a step from you, but each gets there differently.

Duet's purchase flow has two separate checks. Duet confirms the item with you, then Link (Stripe's wallet) asks you to approve the spend, and it pays with a virtual card so your real number is not shared. Muse uses the same Link wallet; Meta says its one-time card keeps your real card details hidden and that Muse is the first agent covered by Link's purchase protections.

OpenAI is the only one that documents advance approval for spending: a dot's purchase with a saved merchant card needs your approval, "which may be given in advance when it specifically covers the purchase." Money transfers are a different category. OpenAI puts them with password changes, as actions you must take over and finish yourself.

Two cost leaks sit outside any approval gate. Perplexity Computer runs on credits (Max subscribers get 10,000 a month); its help page says auto-refill is off until you turn it on and triggers below 500 credits on Pro or 2,500 on Max. Poke's FAQ says Poke Human, included with the $199 a month Ultra plan, has real people run errands for you, and their out-of-pocket costs (an Uber, a coffee order) are deducted from your credit balance at cost. Poke does not document an approval step for those.

For a look at what agents do with money when nobody is watching, our report on seven agents given real bank accounts is the cautionary counterpart to this page.

Where your passwords live: the security design behind each agent

An approval gate stops a bad action. Credential design decides how much damage a tricked agent could do before anyone notices. This is where the vendors differ most, and where Duet borrows the most from earlier engineering.

Why Duet borrows a design from April

Anthropic says Duet's handling of credentials "follows the design we use for Claude Managed Agents, so it never directly sees your passwords or sign-in tokens." The Managed Agents engineering post from 8 April explains why that design exists. In an earlier version, generated code ran in the same container as credentials, so a prompt injection "only had to convince Claude to read its own environment."

The fix was structural. Tokens are either wired into a resource when the sandbox starts (a Git remote, for example) or kept in a vault outside it.

Tool calls go through a proxy that fetches the credential from the vault and makes the call. In Anthropic's words, the loop that runs the agent "is never made aware of any credentials." The engineering post is dated 8 April 2026, more than six months before Duet shipped. Duet runs on Claude Opus 5.5, but the point here is that the model's intelligence is not the safeguard. The wiring is.

Muse reaches a similar place with a different shape. Meta runs a separate Sentinel agent on Muse's machine, "kept apart from Muse at the system level," and nothing Muse does reaches the internet unless the Sentinel approves it. Perplexity described a related idea on 19 October when it open-sourced SPACE, the sandbox behind Computer: credentials and outbound-traffic policy stay outside each task's virtual machine.

Grok Bot carries the one warning every buyer should read. All your Bots share one cloud computer, and xAI says "files, browser sessions, and command line credentials on that computer are available across your Bot roster." Its advice is blunt: "Do not use separate Bots as a security boundary." Deleting a Bot does not remove the shared files or sessions either.

What "only ping when it matters" actually depends on

The skeptic's worry is reasonable. An agent that interrupts you for everything is useless, so every vendor promises restraint. Restraint is a judgment call, and judgment calls fail.

Look at what sits underneath each promise:

1. A fixed list. Duet's four actions and OpenAI's takeover rules do not depend on the agent deciding something is important. A payment is a payment.
2. A classifier. Duet's actions also pass Anthropic's auto mode classifier, the same check used in its coding agent. Dots run on GPT-6 Astra, which OpenAI says is trained to refuse harmful requests, plus an Auto-review step that, before an email goes out, checks the recipient and the message for a wrong address or information you did not mean to share. Grok Bot's Auto Review is model-based.
3. Your own rules. Dots' Custom Rules and Grok Bot's Ask first rules let you tighten things. OpenAI says Custom Rules "cannot turn off core safety requirements."
4. Nothing written down. Poke and Perplexity Computer, on current documentation.

So the honest answer is that "only ping when it matters" describes two different things. It describes how often the agent messages you with news, which really is a judgment and really can miss. It does not, for Duet or dots, describe whether a gated action runs without you. Those are separate systems, and the second one is a rule.

There is one timing detail worth knowing. Grok Bot approvals for work that started without you (a routine, a trigger, a message from another Bot) expire after about 10 minutes, and the action does not run. That fails safe. It also means an overnight task can stall waiting for a tap you never saw.

The case against trusting any of these gates

Here is the strongest argument against taking these lists seriously. Every one of them is the vendor describing its own product. Anthropic says red teams and an outside firm penetration tested Duet, but the launch post does not include their findings, and we found no independent audit of any of the seven approval systems. A written gate is a promise, and OpenAI's own dots FAQ says the safeguards "help reduce risk, but your dot can still make mistakes."

Prompt injection is the sharper version of the same worry. If a web page can talk an agent into treating its instructions as yours, a gate that trusts the agent's description of the action is weaker than it looks. OpenAI's own wording is that its protections reduce that risk "but they do not eliminate it."

The answer is partly yes. Approval prompts are not proof. But the designs are not equal, and the differences are checkable. A hard block on moving money between accounts (Duet), a forced takeover for password changes that no rule can override (dots), credentials the model cannot reach (Duet, Muse, dots for supported sign-ins) and a separate process guarding the network (Muse) all limit what a fooled agent can do, whatever it believes. A model-based reviewer you configured yourself, on a computer shared by every Bot, limits much less.

That is the line we would draw. Trust structure over judgment, and trust judgment over silence.

What to do before you connect an agent to your inbox

Whichever agent you pick, the setup you choose matters more than the brand. These steps come straight from the vendors' own guidance, gathered in one place:

1. Connect the fewest apps you can. Duet, Muse, dots, Grok Bot, Poke and Perplexity all document a way to disconnect an app later. Start with read-only access where it exists; Muse lets you choose whether it only reads email or can also send.
2. Write your own boundaries in. On Grok Bot, add Ask first rules for external email, purchases and deletions. On dots, set Custom Rules for anything you never want done.
3. Never paste a password into chat. Dots' protections only cover supported sign-in forms, not passwords shared "in a chat or document." Grok Bot says the same and asks you to take over the screen instead.
4. Keep local execution off. Grok Bot's default for running commands on your own computer is Ask every time, and xAI recommends Never allow unless a Bot needs local files. On OpenClaw, turn exec.ask on before anything else.
5. Turn off spending you did not plan. Leave Perplexity's credit auto-refill off and set a spending limit.
6. Check the training setting. Poke's privacy policy says data from users who pick Maximum Privacy is not used for model training; dots follow ChatGPT's "Improve the model for everyone" switch.

If you run OpenClaw, an approval layer helps. Clawvisor exists to add exactly that, and our explainer on what Clawvisor is for covers when it is worth the setup. The wider self-hosting trade-offs are in our OpenClaw playbook.

Which agent fits which kind of caution

If you want the strictest written floor, pick Claude Duet. It is the only one of the seven that publishes both a fixed approval list and actions it refuses even with your approval. The catch is access: it is a research preview for Pro and Max subscribers in the US, with a waitlist, and it shares your plan's usage limits with the rest of Claude.

If you want the most control over the rules themselves, pick OpenAI dots. Three tiers of approval, Custom Rules on top, and a takeover floor you cannot switch off. Dots share plugin permissions with ChatGPT, so check what you already connected there. The fuller product picture is in our comparison of Grok Bot, Muse and dots, and the odd naming history is in our explainer on what dots do.

If your worry is the network rather than the action, Meta Muse has the most interesting architecture, with a separate Sentinel watching every outbound request. Small businesses weighing it against a dedicated growth agent can read our Revnu vs Muse breakdown.

If you run a team on Grok Bot from xAI, have an admin lock Auto Review rules before anyone connects a payment method. Poke and Perplexity Computer may well be careful in practice, but until their help pages say which actions pause, treat them as tools for reading and drafting, not for sending or paying. Perplexity's browser, Comet, shares the same credit pool in Work mode.

Still unsure which fits how you work? Smart Match asks about your apps and your risk tolerance and narrows the list. The full field sits in the AI agents directory or our wider ranking of the best AI agents in 2026.

What we could not verify

Three gaps, stated plainly:

• Poke documents integrations, pricing and privacy, but its site, FAQ and docs list no approval gates for sending or spending. Poke is joining Cognition, per its own homepage.
• Perplexity Computer's help center describes an isolated sandbox and connector access, but not which actions pause for your approval.
• Grok Bot documents how approvals work, but not which actions stop by default before you add any rules.

We did not test any agent's gates hands-on for this piece. Every claim above comes from the vendor's own published pages, read on 22 October 2026.

What to watch next

Anthropic says it will share more about how Duet is designed for safety "in the coming days," and that signing in with logins saved in 1Password is coming, with your permission. Muse has the same 1Password support on its roadmap. Once a password manager sits between the agent and your accounts, the credential column above will need redrawing for both.

The test that would change this read is simple: the first independent audit of any of these approval systems, or the first public incident where a gated action ran without a tap. Until one of those lands, the written list is the best evidence you have, so read it before you connect your bank.

Frequently asked questions

Can an AI agent spend my money without permission?

Not by design for Claude Duet, Meta Muse, OpenAI dots or Grok Bot, according to their own documentation. Duet and Muse pay through Stripe's Link wallet with a spend approval and a virtual card, dots need approval for purchases with saved merchant cards, and Grok Bot hands you control for payment confirmations. Poke and Perplexity Computer do not document an approval step.

Which personal AI agent asks before it acts?

Claude Duet publishes the clearest list: it waits for approval before sending a message, making a payment, signing a document or deleting anything. It also refuses to trade securities or move money between accounts even if you approve. OpenAI dots and Meta Muse also document approval for sensitive actions.

Does Claude Duet see my passwords?

Anthropic says no. Duet's credential handling follows the design used for Claude Managed Agents, where tokens are kept in a vault outside the sandbox and a proxy makes authenticated calls, so the agent never directly sees passwords or sign-in tokens.

Is Grok Bot safe to connect to my email?

It can be, if you set it up. Grok Bot's Auto Review is model-based, and xAI recommends adding your own Ask first rules for sending email, purchases and deletions. All your Bots share one cloud computer, so xAI warns not to treat separate Bots as a security boundary.

Does OpenClaw ask before running commands?

Not by default. OpenClaw's documentation says the exec.ask setting defaults to off and host execution defaults to full on gateway and node hosts. Turn asking on and use an allowlist before giving it access to anything that matters.

Covered in this guide

• Claude Duet: Anthropic's research-preview agent on Claude Opus 5.5 watches your connected apps, messages you first, and waits for your OK before it sends, pays or signs.
• Anthropic: Anthropic is a Public Benefit Corporation started by 7 ex-OpenAI researchers. It builds the Claude model family and counts Amazon and Google among its largest backers.
• ChatGPT: ChatGPT is OpenAI's AI assistant, with 1.2 billion weekly users by OpenAI's count, the GPT-6 model family and plans that run from a free tier to a premium Pro tier.
• Claude: Claude is Anthropic's AI assistant, with a free tier, paid personal plans, and Team and Enterprise seats. Opus access starts at the first paid plan.
• Claude Opus 5.5: Anthropic's September 2026 flagship LLM with a 1 million token context window, built for long-running agentic coding and computer use.
• Clawvisor: Open-source authorization gateway for AI agents that vaults credentials and enforces purpose-based access control. YC Spring 2026-backed, free cloud trial.
• Comet: Perplexity's Chromium-based AI browser with a built-in assistant, free on Mac, Windows, iOS and Android, with 7 headline features.
• GPT-6 Astra: OpenAI's flagship model, launched September 2026 as the first ever rated at the Preparedness Framework's Critical cybersecurity level.
• Grok Bot: xAI's always-on AI agents that sign into your existing apps and finish multi-step jobs, included in xAI's joint Grok and Cursor bundle from the Premium tier up.
• Meta: Meta AI ships open-weight Llama (1B+ downloads) and the closed Muse models, led by Muse Wonder with a 1M-token context window.
• Meta Muse: Meta's AI agent runs tasks in its own cloud computer; since 29 Sept 2026 it connects Shopify, QuickBooks, Meta ads and more for small businesses in the US and Canada.
• OpenAI: OpenAI builds ChatGPT, the GPT-6 family (Astra, Sol, Luna), Codex and the OpenAI API. It reports 1.2B weekly ChatGPT users and an $852B valuation after its March 2026 round.
• OpenAI dots: OpenAI's always-on agent in ChatGPT runs on GPT-6 Astra with its own cloud computer, and asks approval before consequential actions.
• OpenClaw: OpenClaw is a free, MIT-licensed agent gateway: one self-hosted process connects your chat apps to the AI model you choose, with the OpenClaw Foundation as steward.
• Perplexity: Perplexity AI is an AI-powered search engine using retrieval-augmented generation to provide accurate, cited answers to questions. Founded by former OpenAI researchers, the company reimagines search through conversational AI.
• Perplexity Computer: Perplexity's autonomous worker runs research, documents and email tasks in a cloud sandbox, with a Mac and Windows app that adds your local files.
• Poke: Text-first personal agent in Apple Messages, WhatsApp and Telegram that handles email and reminders, now part of Cognition (since 23 July 2026).
• xAI: Elon Musk's AI company (roughly 4,000 to 4,900 employees) builds the Grok models and merged into SpaceX, taking the combined business public on Nasdaq as the largest IPO on record.

Sources