Approving changes from AI apps

An AI app connected over MCP can ask to add a rule, delete one, or turn one on or off. It cannot make the change: Outbound’s background agent shows the request to you and makes it only if you allow it, through the same path as an edit you made yourself in Rules.

Ask Me Each Time, or Off

Settings › Intelligence has a “Rule changes” picker with two options:

• Ask Me Each Time (the default): valid pending requests are shown one at a time for approval.
• Off: AI apps can read your figures but requests are refused automatically. The app that asked is told “AI apps may not change rules on this Mac (Settings › Intelligence).”

The approval panel

The panel appears at the top of the screen, over whatever you are doing, with a sound. It shows:

• the AI app’s icon and name, in a heading of the form “Claude Code” wants to change a rule
• what the change is, as a title: “Allow a connection”, “Block a connection”, “Delete a rule”, “Turn a rule on” or “Turn a rule off”
• the change itself, written the way the Rules list writes it, selectable text
• the app’s reason for asking, shown as a quote if it gave one
• two buttons: “Don’t Allow” (Escape) and “Allow” (Return)

A caption under the buttons states the ground rule: “Only you can approve this. Outbound makes the change; the AI app cannot change rules on its own.”

Allow shows “Allowing…” on the button and the panel stays up until the change has actually been applied, so the panel never promises a change that did not happen. The outcome is undoable like any edit in Rules: after an approval, Edit › Undo takes the change back.

The caller waits 180 seconds for an answer. If it withdraws the unclaimed request at that deadline, a later click cannot apply it. The panel checks this when you answer; it is not automatically dismissed at the deadline. If Outbound has already claimed the request, the caller waits up to 120 seconds more. If that also expires, check Rules to see whether the change was applied.

How many requests can wait

Each MCP server process allows at most three waiting rule-change requests. A fourth request to that process is refused straight away: “Three rule changes are already waiting for the person in Outbound. Ask again after they answer.”

What an app may ask for

A requested rule is written in the same words outboundctl rules add takes: an action of allow or deny, a remote (any, local, a domain with wildcards, a host, an address or a network), optional ports and protocol, and an optional app identity. Use a signing identifier with its team identifier unless it starts with com.apple., or use the executable path instead. Leaving the app fields out means any app. Requests that do not parse are refused before they reach you. Adding a rule that loosens protection still goes through the usual confirmation any such change gets.