Most AI agents can now send emails and fill checkout pages. Fewer stop and ask first, and some only do it if you switch a setting on. Here is what triggers an approval in 9 agents, how you approve, and whether it can be turned off, read on each vendor's own help pages.
Checked October 23, 2026. Every claim below was read on the vendor's own help, docs or pricing page that day, linked in place. We list only prices we could read in US dollars. Dooza Crew is our product; we list it last and say where it falls short.
The AI agents that ask before they send or pay, as of October 2026, are ChatGPT Work (cloud browser), Microsoft Copilot, Gemini in Chrome, Claude Cowork in "Manually approve" mode, Lindy (per integration) and Dooza Crew. Zapier Agents and OpenClaw only ask if you set them up to. Fyxer is the safest option for email because it never sends: it only drafts. No vendor guarantees the check: OpenAI says ChatGPT is "designed to" ask, and Google says Gemini "aims to".
| Agent | Asks before | How you approve | Can you turn it off? |
|---|---|---|---|
| ChatGPT Work (cloud browser) | Payments, bookings, other hard-to-reverse actions; new websites | Confirmation in chat | Website access can be set to auto; no off switch found for payment-type confirmations |
| Claude Cowork / Claude in Chrome | Every action in "Manually approve"; file deletion in every mode | "Allow" prompt in the app or Chrome side panel | Yes: Automatically approve or Skip all approvals. Chrome starts in Automatically approve |
| Gemini in Chrome (auto browse) | Sending messages, submitting forms, scheduling; you take over to finish payments | Chrome notification, "Take over" | You can turn auto browse off |
| Microsoft Copilot (Browse with Copilot) | Buying, booking, sending an email, deleting a calendar event | Prompt in Edge; take control of the tab | Not stated on the help page |
| Lindy | Writes to integrations set to "Require approval" | Approve / Deny buttons in a Slack thread | Yes, per integration. Not applied in DMs, web chat, iMessage or SMS |
| Zapier Agents | Only what you tell it to confirm | Back in Zapier, or email/Slack via a Human in the Loop step | Off by default; you add it |
| OpenClaw (self-hosted) | Shell commands, depending on tools.exec.mode | Prompt in your chat app or macOS app | Yes: "full" mode means no approvals |
| Fyxer | Never sends email | You send drafts from your own inbox | n/a |
| Dooza Crew | Clicking Send or Pay; email/SMS and credit tools | Approve, Edit or Reject in chat (web or phone) | Not a user setting; it works by spotting those actions, so it is not perfect |
An agent that browses the web reads text written by strangers, and some of that text is written to hijack it. Anthropic wrote in November 2025 that "no browser agent is immune to prompt injection"; even with its safeguards, Claude Opus 4.5 was fooled in 1.4% of attacks in its test. NIST's AI safety institute reported on March 23, 2026 that in a red-teaming contest with more than 250,000 attacks, "at least one successful attack was found against all of the target frontier models."
That is why the OWASP Top 10 for LLM apps says to "require a human to approve high-impact actions before they are taken." Sending an email and paying money are the two actions you cannot take back, and one wrong email to a client or one wrong payment costs far more than the second it takes to tap Approve.
OpenAI retired "ChatGPT agent" and now points users to ChatGPT Work. Its cloud browser help page says ChatGPT "is designed to request confirmation before actions that could be hard to reverse or create a financial, legal, account, or other real-world commitment, such as confirming a booking or making a payment," and that "it will ask you for confirmation in chat." Website access is a separate setting (Always ask, Auto approve, Always allow), and OpenAI notes that allowing a site "does not remove the need to review an important action."
Cowork has three modes: Manually approve, Automatically approve and Skip all approvals. Per Anthropic's safety guide, "Claude always asks before permanently deleting files, in any mode," and you should switch to Manually approve when "mistakes would be hard to undo, like sending messages or making purchases." The guide also warns that in Skip all approvals "nothing checks its actions." Claude in Chrome starts in Automatically approve, so change it before you let it near your inbox. Pro is $20 a month (claude.com/pricing).
Google's help page says Gemini "aims to ask for your review and confirmation" before sending communications, modifying your data, submitting web forms and scheduling events. For "finalizing financial transactions," it asks you to take over the task. It needs a Google AI Pro or Ultra plan and is limited to the US in English; Pro allows up to 20 auto-browse requests a day.
Microsoft says Copilot "will ask for your attention and supervision for certain actions, such as buying an item, booking a reservation, sending an email, or deleting a calendar event." For consumers it is rolling out to Microsoft 365 Premium subscribers in the US.
Lindy's guardrails let you set each integration to Always allow, Require approval or Don't offer; "reads are never guarded." When approval is needed, Lindy "posts Approve and Deny buttons in the thread." The catch: "Guardrails apply in shared Slack threads only. Your web app chat, Slack DMs with Lindy, and iMessage and SMS aren't guarded." Its email drafting is safe by design: "Nothing goes out without your approval." Team starts at $29.99 a month (lindy.ai/pricing).
Approval is not built in. Zapier's help page tells you to add a sentence like "ask for my confirmation through [messaging app] before continuing," or to add a Human in the Loop step to a Zap "to get approval requests via email or Slack." Agents Pro is $33.33 a month billed yearly (zapier.com/pricing).
OpenClaw's approvals cover shell commands on your machine: "Commands run only when policy + allowlist + (optional) user approval all agree." Its permission modes run from ask to full, the "no-approval posture." The docs also say approvals "are not a per-user auth boundary." We found no documented approval step for sending email. It is free, with your own model costs.
If your worry is email, the simplest answer is an assistant that cannot send. Fyxer's FAQ: "Can Fyxer send emails on my behalf? No. Fyxer drafts replies in your inbox, and you decide what gets sent." Pro is $49 a month, or $37 a month billed yearly.
Dooza Crew gives you a lead agent plus helper agents that you talk to in a chat app on the web or your phone. They browse the web and write files in a private workspace for each user. Before an agent clicks Send or Pay, or uses an email, SMS or credit tool, it asks you in chat: Approve, Edit or Reject. Each account also has a hard cap on AI spend.
Honest limits: the check works by spotting those actions, so it is not perfect, and there is no tool allowlist yet. It runs on one server, so seats are limited. Price: 7-day free trial (card required), then $49 a month including $20 of AI usage (crew.dooza.ai).
Try Dooza Crew free for 7 days, or compare it with ChatGPT Work and Claude.
Want a team of agents that asks you before it clicks Send or Pay? Start a 7-day Dooza Crew trial.
More agent comparisons: Manus alternatives, OpenClaw alternatives and Genspark alternatives.
As of October 23, 2026: Microsoft Copilot (Browse with Copilot) asks before sending an email; Gemini in Chrome auto browse aims to ask before sending communications; Claude Cowork asks for every action in its "Manually approve" mode; Lindy asks in Slack threads for integrations set to "Require approval"; Dooza Crew asks in chat before it clicks Send. Fyxer never sends at all: it only drafts.
ChatGPT Work's cloud browser is designed to ask for confirmation in chat before a payment or booking. Gemini in Chrome asks you to take over to finalize financial transactions. Copilot asks before buying an item. Dooza Crew asks before it clicks Pay. Check each one yourself: OpenAI and Google describe this as a design goal, not a guarantee.
Yes. Claude Cowork has three modes: Manually approve, Automatically approve and Skip all approvals. Anthropic says Claude always asks before permanently deleting files in any mode, and recommends Manually approve when mistakes would be hard to undo, like sending messages or making purchases. Claude in Chrome starts in Automatically approve.
Not by default. Zapier's help page says to add a sentence like "ask for my confirmation through [messaging app] before continuing" to the agent's instructions, or to add a Human in the Loop step to a Zap to get approval requests by email or Slack.
No. It catches the most expensive mistakes, but it depends on the agent recognising which actions need approval. Anthropic says no browser agent is immune to prompt injection, and NIST's 2026 red-teaming found at least one successful attack against every frontier model it tested. Use approvals plus a spending cap and limited account access.
Automate your business with AI employees that work 24/7. Start with a refundable pilot: 100% refund within 14 days.
Manus is independent again after China blocked its sale to Meta, and some users lost data in the split. If you are looking for a replacement, here are 9 alternatives with prices read on each vendor page, who each one fits, and one honest limit for each.
OpenAI's ChatGPT Work and Anthropic's Claude Cowork are both agents for longer tasks that keep going when you close your laptop. Work gets its own cloud browser and hands back finished files; Cowork works on your files and browser through the Claude Desktop app. Both start at $20 a month.
Got busywork? Dooza it.
Start with a refundable pilot — 100% refund within 14 days. A Dooza engineer scopes it with you on a free 30-minute call. Pricing depends on the product; see pricing.
Refundable pilot · 100% refund within 14 days · No contracts
Dooza builds AI products and services for small businesses. Custom Dooza agents start with a refundable pilot: 100% refund within 14 days.
Or start now: Dooza Crew, AI employees you chat with from web or phone, watching every step live in chat: free for 7 days, then $49 a month with $20 of AI usage included. Want it done for you instead? Dooza Managed, $200/month.