Approve AI actions
How action approvals work in the Servor AI copilot — risky and destructive commands always need your confirmation before they run in your browser.
The AI copilot proposes commands, but you decide what actually runs. This page explains when you get an approval prompt, what to look at before you say yes, and why some commands can never run at all.
The core rule is simple: risky and destructive actions always require your approval, in every mode. Nothing dangerous runs behind your back.
When you're asked to approve
Whether a command pauses for your approval depends on two things — the mode and the command's risk:
| Situation | What happens |
|---|---|
| Ask mode | Nothing runs. The copilot only advises. |
| Plan mode | Every command waits for your approval. |
| Auto mode, safe command | Runs on its own; you see the result. |
| Auto mode, risky/destructive command | Pauses and asks for your approval first. |
So in practice you always see risky actions before they happen. Auto only skips the prompt for the ordinary, low-risk commands.
What an approval prompt shows
When the copilot wants to run something that needs your sign-off, you get a prompt showing the exact command it intends to execute on your server. Read it before approving:
Check the command itself
Look at what it actually does — the program, the flags, the target path. The copilot explains its intent in the chat, but the command is what runs.
Check the target
Make sure it's pointing at the right file, service or directory. Destructive commands are only dangerous when aimed at the wrong thing.
Approve or skip
Approve to run it, or decline. If you decline, the copilot adapts and proposes a different step — it doesn't force anything through.
You can always decline
Declining isn't a dead end. The copilot reads your choice as feedback and suggests another approach. If a proposed command looks wrong, skip it and tell the copilot why.
Commands that can never run
Some commands are blocked for everyone — you, your team, and the copilot alike. Servor
enforces a shared blacklist of known-dangerous commands (for example, rm -rf /).
These never run, and no approval can override them. It's the same protection that
applies in the web terminal and to
manual commands.
The blacklist is not a substitute for reading commands
The blacklist catches a handful of catastrophic patterns. It does not make every approval safe — a command can be perfectly valid syntax and still delete the wrong data. Always read what you're approving.
Everything is recorded
Every command the copilot runs — approved by you or run automatically in Auto — lands in the same searchable command history as manual commands and the web terminal. If you ever need to see what happened during a session, it's all there, and team activity is also captured in the audit log — open the audit log in Servor.
If the server goes unreachable
Approvals run the command through your browser to the server's agent. If the agent goes down mid-session, commands stop running until the connection is restored — approving won't help until you repair the agent.