From 06013ae397dfc76db5d053526558b7b7d73da546 Mon Sep 17 00:00:00 2001
From: Sreeram Sreedhar <sreeram@supermemory.com>
Date: Fri, 31 Jul 2026 16:33:48 +0530
Subject: [PATCH] fix(web): make the connection-wide tool default say what it
 does
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"Ask before running" was the label next to an Ask/Allow toggle, so the row
stated one of the two states it was asking you to choose between.

Now reads: Default → "Actions that change things · Creating, editing, sending
— for tools without their own setting below" with [Ask] [Always allow].

Adds the bounds underneath, because the setting is narrower than "allow
everything" and nothing said so: raw queries and code always ask whatever this
is set to, and scheduled runs and borrowed access only ever use tools allowed
individually. Someone flipping this to Always allow could otherwise reasonably
assume their automations had just been given write access.

Per-tool pills now read "Always allow" too, matching this control and the
Slack approval card's button.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../settings/company-brain-tool-approvals.tsx | 46 +++++++++++++------
 1 file changed, 32 insertions(+), 14 deletions(-)

diff --git a/apps/web/components/settings/company-brain-tool-approvals.tsx b/apps/web/components/settings/company-brain-tool-approvals.tsx
index 741a3d41..0a9bc907 100644
--- a/apps/web/components/settings/company-brain-tool-approvals.tsx
+++ b/apps/web/components/settings/company-brain-tool-approvals.tsx
@@ -111,7 +111,7 @@ function ToolRow({
 						disabled={disabled}
 						options={[
 							{ id: "ask", label: "Ask" },
-							{ id: "allow", label: "Allow" },
+							{ id: "allow", label: "Always allow" },
 						]}
 						onChange={(id) => onChange(id as ToolApprovalDecision)}
 					/>
@@ -225,25 +225,33 @@ export default function CompanyBrainToolApprovals({
 			) : (
 				<>
 					<div className="flex flex-col gap-2">
-						<span className={fieldLabel}>Actions that change things</span>
+						<span className={fieldLabel}>Default</span>
 						<div className="flex items-center justify-between gap-3 rounded-xl bg-[#14161A] px-4 py-3 shadow-[inset_2.42px_2.42px_4.263px_rgba(11,15,21,0.7)]">
-							<p
-								className={cn(
-									dmSans125ClassName(),
-									"text-[13px] text-[#FAFAFA]",
-								)}
-							>
-								Ask before running
-								<span className="ml-2 text-[12px] text-[#737B87]">
-									Applies to any tool without its own setting
-								</span>
-							</p>
+							<div className="min-w-0">
+								<p
+									className={cn(
+										dmSans125ClassName(),
+										"text-[13px] text-[#FAFAFA]",
+									)}
+								>
+									Actions that change things
+								</p>
+								<p
+									className={cn(
+										dmSans125ClassName(),
+										"mt-0.5 text-[12px] leading-[1.5] text-[#737B87]",
+									)}
+								>
+									Creating, editing, sending — for tools without their own
+									setting below.
+								</p>
+							</div>
 							<Segmented
 								value={data?.defaultWriteApproval ?? "ask"}
 								disabled={disabled}
 								options={[
 									{ id: "ask", label: "Ask" },
-									{ id: "allow", label: "Allow" },
+									{ id: "allow", label: "Always allow" },
 								]}
 								onChange={(id) =>
 									update.mutate({
@@ -252,6 +260,16 @@ export default function CompanyBrainToolApprovals({
 								}
 							/>
 						</div>
+						<p
+							className={cn(
+								dmSans125ClassName(),
+								"px-1 text-[12px] leading-[1.5] text-[#737373]",
+							)}
+						>
+							Raw queries and code always ask, whatever this is set to.
+							Scheduled runs and borrowed access only use tools allowed
+							individually below.
+						</p>
 					</div>
 
 					<div className="flex flex-col gap-2">