# Approvals and control

URL: https://www.twinly.tech/docs/approvals

Twinly can act on its own or wait for your OK, and you pick which. Whatever you choose, a few things always wait for you, everything it does is recorded, and changes to your calendar, reminders and files can be undone.

### The three approval modes

| Mode | What waits for your OK |
| --- | --- |
| Ask me every time | Every action that changes anything. The safest, and the most tapping. |
| Ask before it ships | Anything that leaves your Mac: messages, mail, calls, money, bookings, and connector actions. Local work (files, folders, the browser, the screen) runs on its own. |
| Don't ask (the default) | Only its questions, messages to family, and spending over your limit. It sends messages, spends money and deletes things without asking first. |

Change it in **Settings ▸ Policy**. The Approvals screen always says what waits in the mode you are in.

> Warning: In **Don't ask**, a mistake reaches real people and real money before you see it. Everything is still recorded and much of it can be undone, but you find out afterwards. If that is not what you want, pick one of the asking modes.

### The send preview

In **Don't ask**, a text or email Twinly sends on its own first shows in the notch for **5 seconds** as the real message, so you can stop it or edit it. Everything it sent stays in the chat as it went out, and a text's card says whether it was delivered. You can turn the preview off in Settings.

Two kinds of work skip the preview, because nobody is at the Mac to see it: an answer to someone who texted **@twinly**, and a job from your own code through the Developer API.

### What waits in every mode

- **Family.** Texts, emails and payments to family, like Mom, Dad or a group named Family, always wait for your OK, with no countdown.
- **Spending over your limit.** A payment over your **Never spend over** amount always waits. One honest limit: Twinly cannot read the total behind a website's checkout button, so the limit cannot stop one of those. Use an asking mode if every purchase should wait.
- **Its questions.** When the twin needs you to decide something, it asks and waits. **Not now** puts a question away, and a question leaves on its own after half an hour.

In the asking modes, payments up to your **auto-approve** amount go through without a card; anything above it waits.

### What an approval looks like

A held step shows as the app it lands in: a Mail draft with its recipients, a blue iMessage bubble, a call card with the goal and opening line, a calendar event. It appears in the notch, on the **Approvals** screen, and as a notification. Approve it, edit it, or choose **Not now**.

- Editing a draft means the original never goes out as it was.
- A card from a task you stopped never sends.
- Replays of tasks the twin has learned pass through the same rules as a fresh run.

### Undo

**Already done**, under the approvals list, is the record of what Twinly did for you. Calendar events, reminders, and file changes have an **Undo** for **30 minutes**: an event or reminder is removed by its exact identity, a changed file gets its previous contents back, and a file the twin created goes to the Trash, never deleted outright.

Sent messages, emails, calls, and payments cannot be undone, and the list says so plainly instead of offering a button that cannot deliver.

### Picking up a stopped task

A task that stops partway (you pressed Stop, a step failed, or you declined one) keeps a record of what it already did. Open it and choose **Pick up where it stopped**: it carries on from there, works around anything you declined, and never sends anything a second time. **Start over** runs it from the beginning instead.

### Stopping the twin

- **Stop** a running task from the island or the app, instantly.
- **End a call**, or mute your twin, from the island at any moment.
- **Decline** a card and nothing goes out.
- **Quit** the app and the twin does nothing until you reopen it. A task that a quit cut off is marked as stopped, never finished in the background.

Every action is also written to a local, tamper-evident log: each entry carries a hash of the one before it, so a record edited after the fact is detectable.