Confirm cards
A confirm card stops a tool at Needs approval — the default for essentially everything that writes — from running. Lucius shows a card describing exactly what would happen, with buttons instead of a plain reply; you’ll see one the first time you ask him to log a transaction. See Permissions for which level a tool starts at and how to change it.
What’s on the card
The tool’s name and what it would do. For a ledger write, that’s the resolved result — account, amount, category, including anything a rule or payee default silently decided — not just the raw text you typed. No preview? The literal arguments about to be sent. Either way: nothing is re-guessed or re-typed at approval time.
Your options
| Button | Effect |
|---|---|
| Allow once (main button) | Runs exactly this call, once. The tool’s stored permission is unchanged — the next call still asks. |
| Always allow (behind the small arrow) | Runs this call and stores always_allow for that tool from now on — every future call, any amount. Revocable later from Settings → Permissions. Read Permissions first: always_allow also fires with nobody watching, including on a schedule. |
| Deny | Refuses just this call. Nothing runs or is written; the stored permission is unchanged. Lucius is told plainly you declined, not that something failed, so he won’t retry or invent a workaround — he’ll ask what you’d prefer instead. |
A card inside an Automation run works the same way, except an “Always allow” you tap there is scoped to that one Automation, not a global permission — see Automations.
What approving actually does
Approval runs on the server against exactly what was staged when the card was built — never whatever the conversation says by the time you tap. Book changed in between (a rule edited, a rate updated) so the same call would now resolve differently? The approval is refused rather than silently applied with different numbers; Lucius shows you a fresh card instead.
Why “no card appeared” doesn’t mean nothing was checked
Tapped Always allow for a tool? Every later call commits immediately and is reported as a short summary instead of pausing — a permission check still ran, it just already had your standing answer. Same for a plain read (checking a balance, listing accounts) and a small, curated set of bookkeeping-only writes (a search cursor, a cached diff) that never ask in the first place. A card exists for everything else still at Needs approval — for a tool you’ve never touched, the default for essentially anything that writes.
Related pages
lucius/permissions— the three levels, in fulllucius/automations— “Always allow” inside a scheduled runlucius/overview— the capability map