---
{
  "id": "platform.local.confirmation-and-remote-approval",
  "topic": "local",
  "title": "Local per-call and remote approval",
  "locale": "en",
  "version": "2026-09-05",
  "summary": "Local desktop actions run after their normal capability checks; filesystem delete alone waits for one bound approval.",
  "content": "The action registry is the confirmation-policy source of truth. Only delete operations use `UserConfirm`: `arinova.local.fs.delete` is the sole confirmed local desktop action. Every other local desktop action uses `None` after its normal capability checks, including file write and move, `shell.run`, app operations, clipboard operations, screen capture, and input actions.\n\nBefore dispatching a confirmed delete, the server persists a one-time binding over the device, call ID, client message ID, sequence, action/version arguments hash, redacted preview, and deadline. Protocol-v2 Desktop shows the exact arguments, reports that the prompt is ready, and does not enter the executor until the server echoes a matching approved decision. Rejection, expiry, disconnect, binding mismatch, replay, and cross-device decisions all fail closed. A desktop `cancelled` result is normalized to `DESKTOP_TOOL_CANCELLED`; report it and never retry automatically unless the user explicitly asks for another attempt.\n\nThe owner may decide the same pending delete binding from the remote-approval UI. Its lifecycle values are `pending`, `approved`, `rejected`, `expired`, and `cancelled`, and every transition is audited with its decision source. A bypass requires a recent 2FA step-up, lasts at most 600 seconds, and stays bound to the user, device, and Agent. The retained legacy shell-bypass validator binds shell to the exact arguments, but non-delete actions do not open confirmation bindings. Never claim execution merely because a prompt or approval exists; wait for the action result.\n",
  "aliases": [
    "desktop confirmation",
    "local approval",
    "remote approval",
    "confirmation cancelled",
    "approval bypass",
    "user away from desktop"
  ],
  "tags": [
    "local",
    "execution",
    "remote-approval",
    "safety"
  ],
  "relatedActions": [
    "arinova.local.fs.read_file",
    "arinova.local.fs.write_file",
    "arinova.local.fs.move",
    "arinova.local.fs.delete",
    "arinova.local.shell.run",
    "arinova.local.shell.which",
    "arinova.local.app.open",
    "arinova.local.app.close",
    "arinova.local.app.list",
    "arinova.local.clipboard.read",
    "arinova.local.clipboard.write",
    "arinova.local.system.open_url",
    "arinova.local.screen.capture",
    "arinova.local.input.click"
  ],
  "relatedActionPrefixes": [],
  "url": "https://docs.arinova.ai/en/kb/local/confirmation-and-remote-approval/"
}
---

The action registry is the confirmation-policy source of truth. Only delete operations use `UserConfirm`: `arinova.local.fs.delete` is the sole confirmed local desktop action. Every other local desktop action uses `None` after its normal capability checks, including file write and move, `shell.run`, app operations, clipboard operations, screen capture, and input actions.

Before dispatching a confirmed delete, the server persists a one-time binding over the device, call ID, client message ID, sequence, action/version arguments hash, redacted preview, and deadline. Protocol-v2 Desktop shows the exact arguments, reports that the prompt is ready, and does not enter the executor until the server echoes a matching approved decision. Rejection, expiry, disconnect, binding mismatch, replay, and cross-device decisions all fail closed. A desktop `cancelled` result is normalized to `DESKTOP_TOOL_CANCELLED`; report it and never retry automatically unless the user explicitly asks for another attempt.

The owner may decide the same pending delete binding from the remote-approval UI. Its lifecycle values are `pending`, `approved`, `rejected`, `expired`, and `cancelled`, and every transition is audited with its decision source. A bypass requires a recent 2FA step-up, lasts at most 600 seconds, and stays bound to the user, device, and Agent. The retained legacy shell-bypass validator binds shell to the exact arguments, but non-delete actions do not open confirmation bindings. Never claim execution merely because a prompt or approval exists; wait for the action result.