Giving them hands

Approvals and the inspector

What an agent asks before it acts, and where to look when the conversation is not enough.

Pragma renders an engine's structured events as cards in the conversation. Questions, choices, permission requests, tool activity and failures stay attached to the task that produced them, which is the difference between reviewing a decision and finding it later in a log.

#Approval cards

When an engine supports approvals, the request appears as a card instead of scrolling past in terminal output.

Read the action and its scope before you approve. Shell commands, file writes outside the working folder, and anything touching a connected service are the ones worth slowing down for.

Denying is not an error. It hands control back to the agent, which can then choose a different route, and that is often the fastest way to correct a plan without cancelling the whole task.

Cancelling a task closes any approval still outstanding, so a stale request cannot be answered after the turn that raised it has ended.

#Always allow

"Always allow" is deliberately narrow. It is tied to a specific issued key and a specific pending request. It is not a switch that grants arbitrary execution afterwards, and it is not something a paired phone can turn into one.

#The inspector

Open Inspector when the conversation does not have the detail you need: individual tool calls, reconnection attempts, raw engine output, the shape of a long-running job.

It is also the first place to look when a run behaves strangely without failing, because the conversation shows what an agent said and the inspector shows what it did.

#When a run disconnects

Transient streaming failures are retried on their own. If the retries end in an authentication or configuration error, the problem is the engine and not the task: fix the CLI's login or path and start again. Retrying the same task against a 401 only produces the same 401.

See Engines and models for detection and path overrides, and Troubleshooting.

#What is actually worth watching for

A short list, in rough order of how much trouble it causes:

• Shell commands carrying rm, mv, or a redirect into a file that already exists.
• Writes outside the working folder you gave the agent.
• Anything that sends a message, posts publicly, or spends money through a connected app.
• Any action on a computer backend where the agent could not say what it expected to see.