want to nerd out about Windows internals. With sandboxes though, uh one of the biggest complaints is always approval fatigue. Um how many of you get like annoyed by approvals, especially for long tasks and like have running full access? All right. And I don't think the audience gets filmed, so like we're going to do this again. Like how many of you know that like IT and security really hates that you turn on full access? >> Yeah. >> Yeah, I know. Uh so, for that reason and uh you know, our own security team wanting to be happy as well, um we worked on um an auto approval mode. And the idea here is really to um derisk some of the like full access things because there are things that can go wrong. As much as these models have gotten better, especially if you're trying to push the model through prompting to really have high agency, that can be misinterpreted by the by the agent to not match up with your expectation like you asking a model to send out a file to through an email, pushing it to have high agency, and it realizes it can't attach the file, so it uploads it to a file share, um and like uses that instead, or messes up some escaping and accidentally deletes too much data. Those things can still happen even with the models getting better. And so, you want to still be careful with these um full access modes. And so, instead, we built auto review with this goal to cover all of the things that are harder to predict that an agent might do and especially in the long run, and um approve those automatically without having to escalate them to you while keeping things like uh data exfiltration outside of it. The way this works is when we um kick off a task that runs into a sandbox like deleting a file in this case, um the model when it tries to escalate spins up an auto review uh subagent. And uh let's see. Didn't do it yet. There we go. So, it spins up an auto review subagent. And this subagent runs entirely separate and can't spin up other subagents and has read permissions only. Um but it we're giving it a bunch of context around sort of how what what is user authorization, which we'll see in a second. How do things like uh risk taxonomies work? How do we want it want it to judge these things? Um and then eventually we give it um the transcript as well as sort of the tool calls that are actually happening. And this is important because the context matters, right? Like in some cases you want the agent to actually delete a file. In other cases you don't. If you ask it to or if it like is part of the project, it makes sense. Especially like things like if you ask it to delete a dot git folder, great. If you didn't ask it to, it should probably not touch that part and like completely delete your history. Um and so we're giving it all of this context and ask it to then come up with um a judgment based on like the user authorization. In this case, it's high because we explicitly told it to delete the file. Um what is the impact of the deletion or like the action itself and what should we do? So, this could apply both to file system actions, but also to network calls for example where like curling Google to see if it if the internet works is fine, but maybe not uploading a file for example. This is a gross oversimplification of all of the thoughts and uh work that went into this by engineers and and the research team. So, if you do want to learn more about it, check out the auto review um blog post that we wrote.