Auto-review
Approvals interrupt you. Auto-review keeps the same boundary and changes who answers the question.
The documentation puts it precisely: auto-review replaces manual approval at the sandbox boundary with a separate reviewer agent. The main agent still runs inside the same sandbox, with the same approval policy and the same network and filesystem limits. What changes is who reviews eligible escalation requests.
When it applies
Only when approvals are interactive, which in practice means approval_policy = "on-request" or a granular policy that still raises the relevant prompt. With never there is nothing to review, because nothing is being asked.
sandbox_mode = "workspace-write"
approval_policy = "on-request"That is the setting auto-review sits on top of. It is not a way to turn approvals off: the boundary is unchanged and the requests still happen.
What it buys, and what it costs
| What you gain | Fewer interruptions on requests that are obviously fine |
| What you give up | A human reading each escalation |
| What does not change | The sandbox, the policy, the network and filesystem limits |
So the question is not whether you trust the reviewer. It is whether the boundary is narrow enough that an escalation being approved without you is acceptable. That is lesson 4's decision, again.
- Work for an afternoon on request and count how many approvals you actually read.
- Narrow the profile until the ones left are ones you want to see.
You understood something today that you didn't yesterday.