In short
- A click only people can give.Approval is a click in the chat, which neither the model nor text on a web page can fake.
- Destructive always asks.Deleting or cancelling can never be set to run without the visitor's approval.
- What they approve is what runs.If the action's inputs change after the visitor approved, the approval no longer counts.
- No invented order numbers.IDs must come from the visitor, the page or an earlier result, never from the model.
An AI that acts on your site is only useful if you can trust it. The big fear: what if it does something nobody asked for? OneType has one rule for that. An action that changes something waits for the visitor's own click.
Three kinds of actions
Every tool you give the agent says what it does to your data. That choice decides whether the visitor is asked.
- Reads, like checking an order status: runs without asking, unless you choose to ask.
- Changes something, like adding to cart: asks the visitor first.
- Destructive, like cancelling an order: always asks, and must have a confirmation question.
A question in your words
You write the question the visitor sees, with placeholders filled from the action's inputs, such as Cancel order #{order_number}? The visitor sees exactly what will happen before it happens. If they decline, nothing runs and the agent is told, so it can offer something else.
Approval that cannot be faked or reused
The approval is tied to the exact inputs the visitor saw. If the call changes after they clicked, the approval is refused. An approval is valid for 5 minutes and runs the action once. The agent can ask at most 5 times in one answer, so a visitor is never flooded with cards.
Text the agent reads on a web page, in a document or in a tool result is treated as data, never as instructions. A line hidden on a page that says approve everything does nothing.
No guessing at IDs
A made-up order number could point at someone else's order. So every argument named like an ID, such as order_number or sku, must use a value the visitor wrote, the page shows, or an earlier tool result returned. Otherwise the call does not run, and the agent is told to look it up or ask. For account data, require a signed-in visitor: your server then receives the verified contact from your own signed token, never a value the model chose.
Where it applies
The same approval rules cover API actions that call your server, site actions that run your page code, and the built-in page tools. Opening a page and filling a form always ask.
Who sets the rules
Owners and admins will decide, per tool, what it does to your data and what question the visitor sees. Each tool says what it does: reads, changes something, or destructive. For reads you can still switch on Ask the visitor first. Setting up tools is coming soon.
Your team never has to watch a live chat to keep actions safe. The rules travel with the tool, and every call to an API action that changes something is recorded in your audit log.