# Approvals > Review changes before they run, allow specific changes for later, and revoke permissions. Reads never ask; organization rules can require approval. Source: https://www.dearjune.ai/docs/settings/approvals Control which changes June may make for you. By default, a change asks first on a card in the chat: review the account, destination and content before approving. Your approval runs that exact change once; a saved permission can let later changes run without another card. A tool call is a **read** or a **change**. Reads never ask: searching your mail, reading a file, listing events. Changes send, create, edit or delete something through a connection or in June’s sandbox. ## The card When June wants to make a change, the reply pauses and a card appears in the thread with the change in full: what it is, which account it runs on, and what it will send or alter. Four choices sit under it: - **Deny** turns it down. June reads the denial and continues. Afterwards, **Add a reason** lets you tell June why; what you type is sent as your own message, so June answers it. - **Always allow** lets this kind of change run without asking from now on, everywhere June works for you: on the web, in Slack, in schedules and in June MCP. It asks once more before it saves the rule: a change that sends something to other people, one that deletes or overwrites, and any other change each have their own note on what you are allowing. Cancelling a calendar event has no **Always allow**: approve it each time, or allow it in this chat. - **Allow in this chat** lets this kind of change run without asking for the rest of this chat only. - **Approve** runs this one change. Several changes asked in one step appear on one card, each with a checkbox. **Approve N** runs the ticked ones and denies the rest; **Deny all** denies them all. Some approval cards come at the end of June's reply instead of beside a step, even when the reply has no text: one card for each batch of changes June asked for together. On the web, June's waiting message also links the card's [approval page](#the-approval-page). Once decided, the card folds to one line: what ran and who allowed it, or why it did not run. **Details** reopens it. A card nobody decides expires after 24 hours; your next message in the chat also moves on from your own waiting cards. If the mobile app shows **Decision pending**, it has not confirmed the result yet. The decision may still be applied. Leave the card open while the app reconnects; its status updates when June confirms what happened. In a shared chat, only the person whose account the change would use can decide it; everyone else sees **Waiting on** that person. After your second approval in a chat, a quiet line offers to **auto-approve changes in this chat**. It never appears in a shared chat. ## The approval page A card can also be decided on its own page, `dearjune.ai/approve/…`: a link June gives a coding agent connected through [June MCP](/docs/june-mcp), or a notification. You must be signed in as the person the card is for; anyone else sees no card. After deciding, the page says **Done. June is continuing in** the chat it came from. ## In the chat's menu Open the thread menu beside the chat's title: - **Auto-approve changes in this chat** lets every change run without a card for this chat. While it is on, the header shows **Auto-approving**; its **×** turns it off. - **Allowed in this chat** lists the kinds of change you allowed here with a card's **Allow in this chat**. **Revoke** makes June ask again. Neither reaches any other chat. Turning off **Auto-approve changes in this chat** does not remove the individual permissions under **Allowed in this chat**; revoke those too if you want June to ask again for them. ## Settings → Approvals Everything permanent lives in **Settings → Approvals**: - **Auto-approve everywhere** lets every change run without a card, in every chat and job. It asks once before turning on. It never skips a change your organization requires a card for, and never runs a command June blocks outright. - **Rules**, grouped by integration and account. Each rule is **Allow**, **Ask** or **Block** for one tool, or for every tool of an account ("All tools"). A card's **Always allow** adds an Allow rule; **Add rule** adds one by hand, searching only tools that make changes. **Remove** deletes a rule. - **Scheduled jobs** lists what each job may change without asking. **Revoke** makes that job ask. - **History** lists every change June asked you about: what it was, where, how you decided, and how it ended. ## What never asks, and what never runs - Reads never ask and have no setting. If June should not read something, disconnect it on the [Integrations](/docs/integrations) page. - June's own bookkeeping never asks: remembering a fact, keeping an artifact, generating an image, searching the web. - Commands that would harm June's sandbox are blocked outright, whatever the rules say. - On an organization’s own connections, its rules can block a change or require a card, whatever your personal permissions say. A blocked change cannot be approved from a card. - Cancelling a calendar event always asks unless you allowed it in this chat or job: no Always-allow rule covers it, **Auto-approve everywhere** included.