Approvals, permissions and safety for AI actions

Whenever AI works in DataMind OS, from a Mind chat to a builder or the Model AI panel, the same safety rules apply behind the scenes: what may run by itself, what always stops for a person, which permissions gate an action, and what the AI can never see. This page collects the rules that hold everywhere; each feature page describes its own cards and messages.

What runs by itself and what asks

• Some actions only read, some make ordinary changes, some are destructive, and a few need a person's consent. Where one tool serves several chats, the platform takes its strictest reading, never the softer one.
• In Manual, every change waits for your decision. In Auto-accept, ordinary changes apply by themselves, while destructive ones still ask. The modes and who may use them are on Warehouse Builder and Lake Builder and Change acceptance for the assistant.
• Consent is never switched off by a mode. A Data access request raises its card in every mode, removing a BI table in Model AI waits for approval even in Unrestricted, and approving a new host for a connector that holds a data access grant always asks an administrator, because granted rows would also be sent to that host.
• A change that waits stops the reply until you decide, and a rejected change is not made. The cards themselves are on Change approval in a builder chat, Approve or reject connector changes and Model AI.
• While the Model Builder is handing a model over, a destructive model change can skip its card only when the check confirms that nothing in use depends on it; when the check cannot decide, the card stays. See Model Builder.
• Nothing fails silently: a refusal or a failed step is reported in the chat with its reason.

Permission gates

• An AI action runs with the permissions of the person it works for. Reads need the area's View permission and changes need its Add/Modify permission, and workflows check their own View and Execute permissions. When one is missing, the action is refused and the message names the permission to ask your administrator for. See Who can do what with Minds and the Permission reference.
• Some actions exist only in the chat they belong to. Warehouse and Lake building actions run only in a Builder chat, and the Model AI's actions run only while its panel is open; outside, the action is refused and the assistant says where it belongs.
• While you view DataMind OS as another user, changes are refused while reads keep working. One exception: a builder cannot run its SQL in that view, and an approval cannot be decided there either. See Impersonate a user.

What the AI cannot see

• Previews and samples leave personal-looking values out before any value is read. A column marked as personal data, or a column whose name looks personal in a table that is not imported yet, is excluded, and the assistant is told which columns were left out.
• Reading source rows at all is a Mind setting, Can Mind Preview Source Data. With it off, the assistant reads no rows and says so; turn it on in the Mind's settings if you want previews. See Mind settings.
• Where a value is withheld, the assistant receives a marker instead: a mask such as **** in text, [removed: nested beyond the PII scan bound] for a block past the scan's limit, and ... [nested value truncated] for a long nested value. A response body that cannot be read as text is described, not shown. Data that is dropped this way is never put back.
• Secret values are never returned to the AI, only names and whether each secret is set. A request for a secret asks you to store it in the vault, and a credential pasted into a chat is moved into the vault, erased from the stored conversation and replaced with a <redacted:NAME> marker. See Connector secrets.

What is recorded, and what stopping does

• Every change the AI makes is recorded, and some changes carry an audit note that names the account behind them. An approval's card keeps its decision: the mode, the action's class, the times and any reason you wrote.
• Stopping a wait ends the wait only. The work keeps running, and its result still arrives in the chat. See Stop and abort runs in chat.
• In the Slides editor, each AI edit is one undo step, and stopping a running edit applies nothing from it. See Write slides with AI.
• A semantic model keeps its AI changes on the History tab, where a person can revert them. See Change history.

Questions, answered

What always waits for approval, even in Unrestricted?

A few requests never depend on the mode. A Data access request raises its card in every mode, removing a BI table in Model AI always asks, and approving a new host for a connector that holds a data access grant always asks an administrator. Ordinary and destructive changes follow the mode instead; the modes are described in Warehouse Builder and Lake Builder.

The assistant asked for data access. What happens next?

The card ends the reply and waits for an administrator. It states the purpose and any suggested object, columns, date column and row cap. The administrator creates the grant in the connector's Data access section, and the assistant can use the rows once it exists. See Connector operations and data access in chat and Data access grants.

Why did an AI action get refused for a missing permission?

Every action is checked against your permissions: reads need the area's View permission and changes need its Add/Modify permission, with workflows on their own View and Execute permissions. When you lack one, the action is refused and the message names the permission to ask for. See Who can do what with Minds and the Permission reference.

Can the assistant change anything while I view DataMind OS as another user?

No. Changes are refused from that view while reads keep working, and an approval cannot be decided there either. A builder cannot even run its SQL in that view. Exit the view, then try again. See Impersonate a user.

Why do some values come back as "****" or "removed"?

Previews and samples leave personal data out before any value is read. A column marked as personal data, or one whose name looks personal in a table that is not imported yet, is excluded, and the assistant is told which columns were left out. Where a value is withheld, the assistant receives a marker instead: a mask such as **** in text, [removed: nested beyond the PII scan bound] for a block past the scan's limit, or ... [nested value truncated] for a long nested value. Data that is dropped this way is never put back.

The assistant says it is not allowed to read source rows. Why?

Reading sample rows from a source is a Mind setting, Can Mind Preview Source Data. With it off, the assistant reads no rows at all and says so. You can turn it on in the Mind's settings if you may edit the Mind. See Mind settings.

What can the assistant see about my secrets?

The names of your stored secrets and whether each one is set, never the values. A request for a secret asks you to store it in the vault, and a credential pasted into a chat is moved into the vault, erased from the stored conversation and replaced with a <redacted:NAME> marker, which is not the value and cannot be used as one. See Connector secrets.

Why does the AI say a tool only works in a Builder chat?

Some actions exist only in the chat they belong to. Warehouse and Lake building actions run only in a Builder chat, and the Model AI's actions run only while its panel is open: if it is closed, the assistant asks you to reopen it from the model editor. It is a scope rule, not a permissions problem. See Warehouse Builder and Lake Builder and Model AI.

Where can I see what the AI changed?

Every change the AI makes is recorded, and some changes carry an audit note that names the account behind them. An approval's card keeps its decision, the mode, the action's class, the times and any reason you wrote (Change approval in a builder chat); a semantic model keeps its AI changes on the History tab, where they can be reverted (Change history). The platform's own AI requests sit in AI, socket and PII logs.