How to choose an AI assistant that asks before it acts

The question behind the question

When people say they want an assistant that asks first, they rarely want a permission prompt on everything. They want two things at once: work that happens without them, and no surprises in front of a customer.

Those pull in opposite directions, so the buying decision is really about where you draw the line, and whether the tool lets you draw it where you want rather than where it was built.

This page is the buyer's version. If you want the mechanics of approval itself, read what approval has to mean first.

Sort your own work before you compare tools

Take the jobs you want to delegate and drop each into one of three buckets. Most disappointment comes from buying for the wrong bucket.

Never needs a tap

Reading, summarising, research, drafting, planning, anything that produces something only you see. A tool that asks permission here is wasting your attention.

Always needs a tap

Anything another person receives, anything involving money, anything that changes a live system. The cost of a wrong action is paid in front of someone else, and you cannot take it back.

Needs a rule, not a tap

The middle, and the interesting part. "Reply to support questions under this length, in this tone, and only about delivery" is a rule you write once. It is not the assistant deciding; it is you deciding in advance.

A tool that only offers the first two buckets will feel either useless or reckless. The middle is where a good one earns its keep.

Seven things to check in a demo

1. Is the preview the real payload? Ask to see exactly what will be sent, not a description of it. Compare it word for word with what arrives.
2. Who holds the permission? If the part that chooses to act is also the part allowed to act, there is no gate.
3. What happens if you never answer? A safe tool does nothing. A timeout that proceeds is not an approval step.
4. What happens when the result is unknown? A request that times out may have gone through. Retrying can send twice. The right answer is stop and reconcile.
5. Can you write rules, and can you read them back? Rules you cannot inspect are not yours.
6. Is there a receipt? Not a log of what the tool believed, but what the other service returned.
7. Is there a stop button that works mid-run? Ask them to press it during the demo.

What the categories get right and wrong

Broadly there are three shapes on the market, and each fails differently.

• Chat assistants are safe because they mostly cannot act. The work stops at your clipboard.
• Workflow builders act reliably, but you specify every branch in advance. They are excellent for the repeatable middle and poor at the messy request you make once.
• Autonomous agents promise the messy request, and this is where approval quality decides whether you can use them at all. Ask the seven questions above and the differences appear quickly.

Our comparison pages put named tools beside Tallis with sources and capture dates, so you can check the claims rather than take ours.

Where Tallis sits

Tallis is built for the third shape with the third bucket taken seriously. Reading, research and drafting run freely. Anything that reaches the outside world is decided by an approval step the runtime cannot bypass: you see the exact artifact and tap, or you set a rule once and Tallis works inside it, or you turn on autopilot for a class of work and get receipts.

Deliberate limits, so you can judge the fit: browser actions are conservative and stop when a site signals a restriction, and the first round covers one account per service rather than a fleet.