Approval policy is now a floor
Your approval policy used to be the mode a new chat started in, which anything downstream could raise. It is now a cap on every run, with a separate cap for the work that runs while you are away.
- Your account approval policy caps every run — chat and side chats, scheduled runs, goals, a run replayed from Lab, and a run resumed after you approve it — rather than only setting a starting point.
- A single turn can no longer ask for more access than your policy allows. An agent's own approval mode, or one sent with an API request, applies only when it is stricter than the policy.
- Unattended automation, in Settings → Configuration, sets the cap for the schedules and goals you own on its own. Keeping one automation able to make changes no longer means removing the approval gate from every chat turn you take.
- Schedules and goals that ran unattended under the default “Ask for approval” policy now read and report without changing anything, because nothing unattended can stop to ask. Existing ones stay read-only until their owner sets Unattended automation in Settings → Configuration.