Access and approvals - Yocrow

Every action is classified as read, write or destructive before it runs. The classification decides whether the agent can run it without you.

Classification	Editor supports approval prompts	Editor without approval prompts
Read	Runs immediately	Runs immediately
Write	Asks for approval	Runs
Destructive	Asks for approval and requires typing the action name	Blocked with `confirmation_required`

Approval prompts

The prompt shows the provider, the action and the full arguments. A declined, cancelled or unanswered prompt blocks the call and returns confirmation_required. An unanswered prompt is cancelled after 30 seconds.

Access profiles

You choose an access profile for each provider during yocrow connect. The profile limits what the provider token can do, whatever the agent requests. Choose a read-only profile for providers the agent must never change.

What is logged

Every provider call is reported to your dashboard with the provider, the action, the outcome and the duration. Arguments are reported only as a SHA-256 digest. Results are never sent to Yocrow.