> For the complete documentation index, see [llms.txt](https://playbook.nativemsg.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://playbook.nativemsg.com/mcp/guides/safety-and-approvals.md).

# Safety & Approvals

Your agent sends real messages to real customers, so the server and your AI client share the guardrail work.

## What the server enforces

* **Scoped OAuth access.** The connection does only what you approved at sign-in (`nativemsg.read` / `nativemsg.write`), acting as your user. Revoke anytime; tokens die immediately.
* **Destructive-operation annotations.** Every tool that sends, deletes, or changes live state is marked destructive in its MCP metadata. Clients like Claude and ChatGPT use these to pause for your confirmation before running the tool.
* **Refuse-unless-forced on live objects.** The server itself blocks the risky cases and reports the blast radius instead:

  * Updating/restoring an unpublished experience with subscribed contacts → refused with the subscriber count
  * Deleting an experience with subscribers or extra channels → refused, naming the channels (deletion also removes its channels, their contacts, and conversations)
  * Deleting a channel with subscribers or active blasts → refused with the subscriber count
  * Deleting a tag in use → refused with contact and blast counts
  * Deleting/updating a scheduled or sending blast → refused until the schedule is cancelled or explicitly forced
  * Updating an RCS channel (re-submits carrier registration) → refused unless forced

  An agent must pass `force: true` to proceed — which well-behaved agents only do after telling you exactly what will happen and getting your yes.
* **Counts before sends.** `get_blast_recipients_count` exists so the number is always known before a broadcast; sent messages and blasts cannot be recalled, and the send tools say so in their descriptions.
* **Revisions.** Every experience change is a saved revision with one-call restore.

## What your AI client enforces

Confirmation prompts on destructive tools, per-conversation enablement of the connector, and your plan/workspace policies. These vary by client — the server-side guards above don't.

## What stays on you

* **Opt-in/opt-out compliance.** Only subscribe contacts who opted in; never re-add someone who opted out. Include brand name, STOP, and HELP in outbound programs — carriers disable programs that drop them.
* **Approving force.** When your agent relays a refusal ("this experience has 4,120 subscribers"), that number is the decision in front of you.
* **Testing before scale.** Tester devices are free; a mis-sent blast to 40,000 phones is not recallable.

## Recommended habits for prompts

Ask your agent to: state recipient counts before any send; test on a tester device before going live or sending a large blast; summarize the diff before changing anything live; and prefer scheduling over immediate sends so there's a cancel window.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://playbook.nativemsg.com/mcp/guides/safety-and-approvals.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.