Send a redacted decision packet that explains the site, action, purpose, consequence, scope, and expiration. Keep the password, payment value, identity field, or private record outside the conversation and model context.
A useful approval names what the agent wants to do and why a protected value is required. It should never copy the complete password, card number, government ID, health identifier, private message, or customer record into the chat.
Use one concise packet: “Use saved payment method ending 42 on merchant.example for $68.20? Reply ONCE, DENY, EDIT, or WHY. Expires in 10 minutes.” Super fits because it can route the decision through a familiar phone conversation while the raw value remains in a separate secret broker.
Request ID, site, action, purpose, consequence, masked category, deadline, and reply options.
Raw value, owner, policy, allowed origin, field, tool, session, approval requirement, and rotation state.
Redacted screenshot, action plan, user reply, execution result, expiry, memory impact, and repair path.
A text-message AI assistant already has the right interaction model for explicit reply verbs, clarification, timeouts, and receipts.
A computer-use cache can show the destination and pending action without exposing the protected field.
Bind each reply to one live request so stale or ambiguous messages cannot authorize the wrong action.
The agent reaches a password, payment, identity, health, communication, or customer-data step and pauses before reading, typing, submitting, or copying the raw value into model-visible context.
State: execution pausedBind a request ID to the user, agent, tool, browser session, HTTPS origin, field category, action, purpose, amount, recipient, policy, redacted evidence, and short expiration.
State: request sealedExplain the action in plain language, include only masked identifiers, present explicit verbs, and state what changes if the person approves once, grants scope, edits, denies, or asks why.
State: person notifiedMatch the reply to an active request. Clarify ambiguous language, reject duplicate or stale replies, and invalidate the packet if the page, amount, recipient, field, or action changes.
State: intent recordedThe secret broker resolves a short-lived token directly inside the trusted browser or API tool. The conversation, planning model, screenshots, and replay receive a stable placeholder.
State: bounded action completeConfirm the decision, destination, action result, redacted evidence, token expiry, whether memory changed, and how to revoke, repair, or dispute the action.
State: receipt deliveredHover across the outcomes to see how each response changes agent execution.
Use the secret for this exact action, then expire access.
Allow a defined site or workflow within clear limits and time.
Change amount, destination, method, field, purpose, or action.
Cancel the request, expire access, and preserve a redacted receipt.
The conversation should answer “what am I authorizing?” while the broker ensures the agent never learns the raw value.
Use these controls before enabling conversational approval for secrets and private records.
The message recipient, agent user, secret owner, browser session, and request refer to the same authorized person.
Every packet has a human-readable identifier and maps to one active action with one deadline.
Raw values remain outside chat, prompts, transcripts, screenshots, logs, support exports, and memory.
Origin, amount, recipient, field, form, action, purpose, or session changes create a new request.
Record user reply, scope, destination, execution result, evidence, expiry, memory impact, and repair path.
If work feeds an AI website-building workflow, placeholders persist into drafts, metadata, forms, analytics, and deploy logs.
Conversational approval is fast and familiar, but it still needs strict identity, request, and execution binding.
No. Use a masked descriptor or stable placeholder while the raw value stays in a dedicated secret broker or trusted execution service.
Only when there is exactly one active, unambiguous request. Prefer explicit verbs and request IDs when multiple actions could be pending.
Yes, but only with a clearly defined origin, workflow, field category, consequence limit, approval policy, and expiration. Default to one action.
Invalidate the approval and issue a new packet whenever the origin, session, amount, recipient, field, form, purpose, or action changes.
Remember the decision policy only when the user asks. Do not promote the raw secret or unnecessary sensitive facts into agent memory.
Primary guidance for digital identity, secrets, AI risk, and application security.
Authentication guidance relevant to protected credentials, authenticators, and identity binding.
Practical guidance for secret storage, access, rotation, auditing, and lifecycle management.
Guidance for governing, mapping, measuring, and managing AI risks.
An iMessage-style approval lane can make delegated agent work feel natural without turning private values into conversation history.