Most of what the agent does runs at once. A few things hand out control of the site: putting a plugin in, or giving someone an account that runs it. Since Delta 0.4.2 those wait for your approval in wp-admin. The agent cannot approve them itself, and no text it reads can either.
What waits for your approval
- Plugins. Installing, updating, activating or deleting a plugin, and installing or activating an integration.
- Accounts that run the site. Creating an administrator or an editor, changing the role, email or password of one, or deleting one. The same goes for any role that can manage users, plugins or settings.
- Settings that open the site. Making such a role the default for new users, opening registration while the default role is one of them, and Coming Soon’s Let static exports through.
Everything else runs as before: pages, templates, the design system, media, ordinary users, forms, products.
How it goes
- You ask the agent for something on the list. Instead of a result, the agent gets a link, and tells you what it wants to do.
- Open the link. It leads to Delta → Approvals in wp-admin, where the request is written out in full: which ability, which plugin or account, which values. A password is masked.
- Click Approve or Deny.
- Tell the agent to go ahead. It repeats the same request, and the request runs once.
“Install WPForms Lite.” The agent answers with the link. You approve. The agent installs it.
The rules
- An approval is for one request, exactly as shown. A changed request needs a new approval.
- It lasts 15 minutes, and it is used once.
- Any administrator can approve or deny, not only the one the agent is connected as. The screen shows who asked, and keeps who decided.
- A request the site would refuse anyway, such as a plugin that is already installed, does not wait. It is answered at once.
- Delta → Approvals shows in the menu only while something is waiting.
Switching it off
The approval step is on by default. You can switch it off under Delta → Context → Guardrails, in the group Enforced By Site. With it off, these requests run at once, as they did before 0.4.2, and Site Health reminds you to turn it back on. The agent cannot change this setting.
We recommend keeping it on, on a client site above all. It costs you a click now and then, and it is the one step that stands between a tricked agent and a new administrator.
For developers
A held call answers 21press_delta_confirmation_required with confirmationId and approveUrl. The agent calls the same ability with the same input plus confirmationId. Before a decision it gets confirmation_pending; after a denial confirmation_denied; for another input, user or ability, or after 15 minutes, confirmation_invalid. The setting is security_layer; update-theme-settings refuses it.
Related: Security · Skills, rules, and guardrails · Changed by an agent panel