Approvals
Waiting · 3 Example
Waiting
ops-agent wants to pay invoice 2026-118 2m ago repo-helper wants to run a command 4m ago support-bot wants to send an email 9m ago Spends money
ops-agent wants to pay invoice 2026-118 Asked 2m ago
The exact request
Pay invoice 2026-118: 4,800 EUR to Acme GmbH Item 2026-118 Why you are asked Payments wait for a person Don’t allow
Nothing happens until you allow it. Allowing lets this exact request run once. Change what needs your OK
Agent ops-agent Tool pay_invoice · pay Held requests wait with their exact text. Allow once, or don’t.
Rules for ops-agent
Example
Read a ticket read_ticket.read Allow Ask me first Never
Send an email send_email.send Allow Ask me first Never
Pay an invoice pay_invoice.pay Delete a record delete_record.delete Allow Ask me first Never
Run a command shell.run Allow Ask me first Never
Anything not listed is blocked. Paying always asks first.
Test a call
Read ticket T-1042 support-bot · read_ticket.read Send email to anna@customer.example: “Your refund is on its way” support-bot · send_email.send Pay invoice 2026-118: 4,800 EUR to Acme GmbH ops-agent · pay_invoice.pay Delete customer record C-311 ops-agent · delete_record.delete Run: git push --force origin main repo-helper · shell.run Run SQL: DROP TABLE customers research-agent · database.query send_email.send
The rule says Ask me first. Nothing runs until you answer.
Allow once Don’t allow
Allow, Ask me first or Never, per tool. Anything not listed is blocked.
Time Agent Request Outcome
14:02 ops-agent Pay invoice 2026-118: 4,800 EUR to Acme GmbH pay_invoice.pay 14:00 repo-helper Run: git push --force origin main shell.run 13:58 support-bot Read ticket T-1042 read_ticket.read 13:44 ops-agent Delete customer record C-311 delete_record.delete 13:31 research-agent Run SQL: DROP TABLE customers database.query 13:12 support-bot Send email to anna@customer.example: “Your refund is on its way” send_email.send 12:50 repo-helper Run: git push --force origin main shell.run 14:00 · repo-helper
Run: git push --force origin main
Decided by Rule: Ask me first
Tool shell.run
Hash #e0b25d Every request and decision, hash-chained to the one before.
ops-agent
Pays invoices and answers billing mail
1 request waiting
Revoke key
repo-helper
Works in the code repository
1 request waiting
Revoke key
support-bot
Answers support tickets
Last request 46m ago
Revoke key
research-agent
Reads docs and writes summaries
Last request 38m ago
Revoke key
Each agent has its own key. Revoke one, the others keep running.
Protection checks · ops-agent
Example
These checks show only what Tend itself could confirm, one claim at a time. They are not a security rating, and they say nothing about the computer your agent runs on.
Checked on this server now
Read from Tend’s own settings and records. Nothing was changed, and no note was opened.
The notes folder is closed to other accounts on this computer Tend raises an alert if this agent says it acted without asking Every action Tend ran that needed your approval had one Each approval was used only once Whether the agent has ever reported acting outside Tend Tested on a private copy
Run on a throwaway copy of Tend with invented data, using this agent’s current rules. This shows how Tend behaves; it doesn’t test your live data.
Tend refuses what your rules forbid Tend refuses made-up actions, hidden folder paths and web addresses When you set an action to “Ask me first”, Tend waits for your decision An action you reject never runs An approval works once, and only for what you approved
What this shows On a private copy, Tend refused a changed request, another agent using the approval, a second use, and use after the pass expired. The approved action ran exactly once.
What it does not show Overlapping requests on your live database (our automated tests cover that on PostgreSQL), or what happens outside Tend. Tend checked this and it held.
Beyond what Tend can see
Things only you, or whoever runs your agent, can confirm.
Your agent can’t open the notes folder or hold Tend’s passwords One claim per check: Verified, At Risk or Not Verified.
Your agent
Never holds the key
Payments API
pay_invoice.pay · 1×
TEND holds the credential and runs the tool itself, once.
$ npm run tend -- pending
az_7f2c ops-agent wants pay_invoice.pay 2026-118
exactly: Pay invoice 2026-118: 4,800 EUR to Acme GmbH
$ npm run tend -- approve az_7f2c
Allowed once: az_7f2c See what waits, approve and read the log from your terminal.
Anthropic Google Gemini Mistral AI Ollama Claude Code Cursor Hooks, adapters and an MCP proxy for the agents you already run.
Approvals
Waiting · 3 Example
Waiting
ops-agent wants to pay invoice 2026-118 2m ago repo-helper wants to run a command 4m ago support-bot wants to send an email 9m ago Spends money
ops-agent wants to pay invoice 2026-118 Asked 2m ago
The exact request
Pay invoice 2026-118: 4,800 EUR to Acme GmbH Item 2026-118 Why you are asked Payments wait for a person Don’t allow
Nothing happens until you allow it. Allowing lets this exact request run once. Change what needs your OK
Agent ops-agent Tool pay_invoice · pay Held requests wait with their exact text. Allow once, or don’t.
Rules for ops-agent
Example
Read a ticket read_ticket.read Allow Ask me first Never
Send an email send_email.send Allow Ask me first Never
Pay an invoice pay_invoice.pay Delete a record delete_record.delete Allow Ask me first Never
Run a command shell.run Allow Ask me first Never
Anything not listed is blocked. Paying always asks first.
Test a call
Read ticket T-1042 support-bot · read_ticket.read Send email to anna@customer.example: “Your refund is on its way” support-bot · send_email.send Pay invoice 2026-118: 4,800 EUR to Acme GmbH ops-agent · pay_invoice.pay Delete customer record C-311 ops-agent · delete_record.delete Run: git push --force origin main repo-helper · shell.run Run SQL: DROP TABLE customers research-agent · database.query send_email.send
The rule says Ask me first. Nothing runs until you answer.
Allow once Don’t allow
Allow, Ask me first or Never, per tool. Anything not listed is blocked.
Time Agent Request Outcome
14:02 ops-agent Pay invoice 2026-118: 4,800 EUR to Acme GmbH pay_invoice.pay 14:00 repo-helper Run: git push --force origin main shell.run 13:58 support-bot Read ticket T-1042 read_ticket.read 13:44 ops-agent Delete customer record C-311 delete_record.delete 13:31 research-agent Run SQL: DROP TABLE customers database.query 13:12 support-bot Send email to anna@customer.example: “Your refund is on its way” send_email.send 12:50 repo-helper Run: git push --force origin main shell.run 14:00 · repo-helper
Run: git push --force origin main
Decided by Rule: Ask me first
Tool shell.run
Hash #e0b25d Every request and decision, hash-chained to the one before.
ops-agent
Pays invoices and answers billing mail
1 request waiting
Revoke key
repo-helper
Works in the code repository
1 request waiting
Revoke key
support-bot
Answers support tickets
Last request 46m ago
Revoke key
research-agent
Reads docs and writes summaries
Last request 38m ago
Revoke key
Each agent has its own key. Revoke one, the others keep running.
Protection checks · ops-agent
Example
These checks show only what Tend itself could confirm, one claim at a time. They are not a security rating, and they say nothing about the computer your agent runs on.
Checked on this server now
Read from Tend’s own settings and records. Nothing was changed, and no note was opened.
The notes folder is closed to other accounts on this computer Tend raises an alert if this agent says it acted without asking Every action Tend ran that needed your approval had one Each approval was used only once Whether the agent has ever reported acting outside Tend Tested on a private copy
Run on a throwaway copy of Tend with invented data, using this agent’s current rules. This shows how Tend behaves; it doesn’t test your live data.
Tend refuses what your rules forbid Tend refuses made-up actions, hidden folder paths and web addresses When you set an action to “Ask me first”, Tend waits for your decision An action you reject never runs An approval works once, and only for what you approved
What this shows On a private copy, Tend refused a changed request, another agent using the approval, a second use, and use after the pass expired. The approved action ran exactly once.
What it does not show Overlapping requests on your live database (our automated tests cover that on PostgreSQL), or what happens outside Tend. Tend checked this and it held.
Beyond what Tend can see
Things only you, or whoever runs your agent, can confirm.
Your agent can’t open the notes folder or hold Tend’s passwords One claim per check: Verified, At Risk or Not Verified.
Your agent
Never holds the key
Payments API
pay_invoice.pay · 1×
TEND holds the credential and runs the tool itself, once.
$ npm run tend -- pending
az_7f2c ops-agent wants pay_invoice.pay 2026-118
exactly: Pay invoice 2026-118: 4,800 EUR to Acme GmbH
$ npm run tend -- approve az_7f2c
Allowed once: az_7f2c See what waits, approve and read the log from your terminal.
Anthropic Google Gemini Mistral AI Ollama Claude Code Cursor Hooks, adapters and an MCP proxy for the agents you already run.
Approvals
Waiting · 3 Example
Waiting
ops-agent wants to pay invoice 2026-118 2m ago repo-helper wants to run a command 4m ago support-bot wants to send an email 9m ago Spends money
ops-agent wants to pay invoice 2026-118 Asked 2m ago
The exact request
Pay invoice 2026-118: 4,800 EUR to Acme GmbH Item 2026-118 Why you are asked Payments wait for a person Don’t allow
Nothing happens until you allow it. Allowing lets this exact request run once. Change what needs your OK
Agent ops-agent Tool pay_invoice · pay Held requests wait with their exact text. Allow once, or don’t.
Rules for ops-agent
Example
Read a ticket read_ticket.read Allow Ask me first Never
Send an email send_email.send Allow Ask me first Never
Pay an invoice pay_invoice.pay Delete a record delete_record.delete Allow Ask me first Never
Run a command shell.run Allow Ask me first Never
Anything not listed is blocked. Paying always asks first.
Test a call
Read ticket T-1042 support-bot · read_ticket.read Send email to anna@customer.example: “Your refund is on its way” support-bot · send_email.send Pay invoice 2026-118: 4,800 EUR to Acme GmbH ops-agent · pay_invoice.pay Delete customer record C-311 ops-agent · delete_record.delete Run: git push --force origin main repo-helper · shell.run Run SQL: DROP TABLE customers research-agent · database.query send_email.send
The rule says Ask me first. Nothing runs until you answer.
Allow once Don’t allow
Allow, Ask me first or Never, per tool. Anything not listed is blocked.
Time Agent Request Outcome
14:02 ops-agent Pay invoice 2026-118: 4,800 EUR to Acme GmbH pay_invoice.pay 14:00 repo-helper Run: git push --force origin main shell.run 13:58 support-bot Read ticket T-1042 read_ticket.read 13:44 ops-agent Delete customer record C-311 delete_record.delete 13:31 research-agent Run SQL: DROP TABLE customers database.query 13:12 support-bot Send email to anna@customer.example: “Your refund is on its way” send_email.send 12:50 repo-helper Run: git push --force origin main shell.run 14:00 · repo-helper
Run: git push --force origin main
Decided by Rule: Ask me first
Tool shell.run
Hash #e0b25d Every request and decision, hash-chained to the one before.
ops-agent
Pays invoices and answers billing mail
1 request waiting
Revoke key
repo-helper
Works in the code repository
1 request waiting
Revoke key
support-bot
Answers support tickets
Last request 46m ago
Revoke key
research-agent
Reads docs and writes summaries
Last request 38m ago
Revoke key
Each agent has its own key. Revoke one, the others keep running.
Protection checks · ops-agent
Example
These checks show only what Tend itself could confirm, one claim at a time. They are not a security rating, and they say nothing about the computer your agent runs on.
Checked on this server now
Read from Tend’s own settings and records. Nothing was changed, and no note was opened.
The notes folder is closed to other accounts on this computer Tend raises an alert if this agent says it acted without asking Every action Tend ran that needed your approval had one Each approval was used only once Whether the agent has ever reported acting outside Tend Tested on a private copy
Run on a throwaway copy of Tend with invented data, using this agent’s current rules. This shows how Tend behaves; it doesn’t test your live data.
Tend refuses what your rules forbid Tend refuses made-up actions, hidden folder paths and web addresses When you set an action to “Ask me first”, Tend waits for your decision An action you reject never runs An approval works once, and only for what you approved
What this shows On a private copy, Tend refused a changed request, another agent using the approval, a second use, and use after the pass expired. The approved action ran exactly once.
What it does not show Overlapping requests on your live database (our automated tests cover that on PostgreSQL), or what happens outside Tend. Tend checked this and it held.
Beyond what Tend can see
Things only you, or whoever runs your agent, can confirm.
Your agent can’t open the notes folder or hold Tend’s passwords One claim per check: Verified, At Risk or Not Verified.
Your agent
Never holds the key
Payments API
pay_invoice.pay · 1×
TEND holds the credential and runs the tool itself, once.
$ npm run tend -- pending
az_7f2c ops-agent wants pay_invoice.pay 2026-118
exactly: Pay invoice 2026-118: 4,800 EUR to Acme GmbH
$ npm run tend -- approve az_7f2c
Allowed once: az_7f2c See what waits, approve and read the log from your terminal.
Anthropic Google Gemini Mistral AI Ollama Claude Code Cursor Hooks, adapters and an MCP proxy for the agents you already run.
