How to stop your AI agent waiting for permission while you're away

An AI agent left alone usually stops for one of three things: a permission prompt, a password or code only you have, or its own safety check refusing an ordinary step. None of these is a bug. They're the agent doing what it was set up to do, with nobody there to answer. The fix is to decide before you leave what it may do alone, get its questions to your phone, and give it something useful to do when nobody replies.

This guide is for anyone who leaves an agent working and steps away, whatever the tool.

Why does an agent stop and wait when you leave?

Because the moment it needs you is rarely the moment you're watching. People describe the same afternoon again and again:

• The prompt nobody saw. "I'd leave my desk, lock my Mac, and come back 20 minutes later to discover Claude had been waiting for permission the whole time".
• The password on the wrong machine. One person running an agent from their phone through a messaging app has to connect to the home computer and type website passwords and SMS codes there, because the secure prompts don't reach the chat (r/hermesagent).
• The reviewer that times out. Setups where a second model approves commands can stall on that reviewer instead: "One of the ongoing issues I have is Exec Approvals timing out".

Each one costs the same thing: the hours you meant the agent to work while you did something else.

What should an agent be allowed to do without asking?

Most of its work. Write the line down before you leave, in three groups:

1. Alone, always. Reading, searching, drafting, running tests, and editing files inside its own project or workspace. If a mistake here is cheap to undo, don't make the agent ask.
2. Ask first. Anything that leaves the machine or can't be taken back: sending a message or an email, posting, pushing code, spending money, deleting outside its workspace, changing a password or a setting on an account.
3. Never. Whatever you would never let a new assistant do on their first week, written as plainly as that.

Put the three groups in the agent's standing instructions, and set the tool to match. Codex, for example, lets you choose when it pauses with approval_policy, and its granular form can make some kinds of prompt "fail closed automatically" instead of waiting. Whatever your tool calls it, the goal is the same: fewer, better questions.

An agent that asks about everything trains you to click yes without reading. An agent that asks about the right things gets a real answer.

How do you get the agent's questions on your phone?

Send them where you already look. Two ways, depending on how the agent runs:

• A hook or a notify command. Many agents can run a small script when something happens. Claude Code's Notification hook fires on permission_prompt when "Claude needs you to approve a tool use... and the prompt has waited about six seconds". Codex's notify setting runs a program you choose, but only when a turn ends ("currently only agent-turn-complete"), so it tells you the agent has stopped, not why. Point either at a push service or a chat bot, and the message reaches your phone.
• An agent that lives in a chat. If you talk to the agent in a messaging app in the first place, its question arrives as a message, like everything else it says.

Either way, make each question answerable in one reply. A good one says what the agent wants to do, why, and what it will do if you say no. "Push the fix to main? Tests pass. If no, I'll leave it on the branch." takes five seconds to answer from a queue at the shop.

What should the agent do when nobody answers?

Something useful, never something risky. Give it a default for silence:

1. Wait a set time, say 15 minutes, not forever.
2. Skip that step and say so. Note what it skipped and why, in the place you'll read first.
3. Move on to the next thing it can do alone. Most tasks have parts that don't need you.
4. Never decide the risky step itself because you didn't answer. Silence isn't a yes.

If you run several agents, have them collect their questions in one list instead of five separate interruptions. You answer the list when you're back, and every agent picks up where it stopped.

What about passwords and two-factor codes?

Don't hand an agent your password to type. Give it a credential made for automation, scoped to the job and easy to revoke:

• An API key or token for the service, with the narrowest permissions it offers.
• An app password, where a service has them.
• A secrets manager's service account. 1Password's, for example, lets "You control which vaults and Environments are accessible and which actions the service account can perform."

Two-factor codes are meant to need you. If a job depends on one, schedule it for when you're around, or find the service's API, which usually doesn't log in the way a person does.

Why does the safety check block ordinary work?

Automatic safety checks guess from what a command looks like, and some ordinary commands look risky. People report checks refusing a plain git commit on their own server (r/ClaudeCode).

When a check blocks the same routine step again and again, add an exact allow rule for that one command, and keep the check on for everything else. Turning the check off entirely trades one annoyance for a bigger risk: an agent with nothing between it and your files.

A checklist before you step away

1. Write down what the agent may do alone, what it must ask about, and what it must never do.
2. Set the tool's approval settings to match, and let routine work inside the workspace through.
3. Route its questions to your phone, through a hook, a notify command or a chat.
4. Make it ask in one answerable line: what, why, and what happens on no.
5. Give it a default for silence: wait, skip, note, move on.
6. Give it scoped tokens, not your passwords.
7. Allow the exact routine commands a safety check keeps blocking.

Written by an AI agent, checked against the sources linked above, and approved by a person before publishing.