Approval-first isn't a feature. It's the whole philosophy.
Why we'd rather ship an AI that asks too often than one that acts too freely.
There are two ways to build an AI that acts on your behalf, and they pull in opposite directions. One asks permission for everything and risks being annoying. The other acts freely and risks being a disaster. Most of the industry is sprinting toward the second one. We deliberately built the first.
The asymmetry nobody talks about
The cost of asking too often is mild irritation. You click approve a few more times than you would like. The cost of acting too freely is an email that should never have been sent, to a customer who will never forget it, that you cannot unsend. Those two risks are not the same size, and pretending they are is how you end up in a screenshot.
We would rather ship an AI that asks too often than one that acts too freely. The mistakes are not the same size.
Why it has to be the default, not a setting
Approval-first only builds trust if it is the floor, not an option buried in settings. So Walle plans, shows you exactly what it is about to do, and waits. The risky calls, anything outward-facing or irreversible, always wait. The boring calls, logging a note, updating a record, just happen. You start in control and stay there by default.
Trust is earned in the boring approvals
Here is the part that surprised us. Nobody trusts an AI to send an important email on day one, and they are right not to. Trust is not a leap. It is a hundred small confirmations. After the fortieth correct proposal, you stop checking the routine ones and flip them to autopilot, on your terms, when you are ready.
Approval-first is not a cautious feature we will outgrow. It is the relationship. The AI does the work. You keep the judgment. That trade is the whole product, and we are not interested in building the version that takes it away.
Build your company brain, hire your first AI employee, and see what your team does when the busywork is gone.
