Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Does Manually Approve Mode Do in Claude in Chrome?
Manually approve mode stops Claude before every action it proposes and waits for a person to accept or reject it, so a browser run advances one reviewed step at a time. The prompt arrives after the page has been read, so check what the model received on the screen before the first approval.
Procurement and security teams weighing Claude in Chrome for supplier work should start with how manually approve mode behaves: it proposes one step at a time, and the agent reads the page, decides what to do next, and waits for a person to accept or reject that action before anything happens. The setting is simple to state and easy to overrate, and the organization answers for the trade it makes. It puts a person in front of every click, so the run moves at the speed of someone reading a list of proposals, and it leaves the moment before the proposal untouched, when the model took in the page and everything visible on it. A ten-step vendor onboarding in a procurement portal makes both halves concrete: ten steps mean ten or more approvals, and the supplier record's tax identifier and bank details sit on the portal pages the agent reads to decide what step two should be. Watch where the reviewer's attention goes across those ten prompts, and watch where the values went before the first prompt appeared. Those two questions do not have the same answer, and the gap between them is where a reviewed run can still hand a supplier's bank account to a model.
Key findings
- For those values to stay out of the model, the rendered screen would have to show consistent tokens such as VENDOR_001 before any model reads it, with real values resolved only at the approved destination (What Is an AI Control Record?).
- It would also require a named person approving each submission and record change, and a record of what the model received on each screen, exported to the organization's own monitoring (What Is Supervised Delegation?).
- Anthropic's help center describes site blocking, permission prompts and password-manager fills for Claude in Chrome, and does not describe replacing values on a page before the model reads it (Anthropic, Safely, 2026).
- Anthropic's help center states that Claude "takes screenshots of your active browser tab" and that "Whatever is visible in one of those tabs is captured in the screenshots and becomes part of the conversation" (Anthropic, Safely, 2026).
- Anthropic's Get started page says the side panel defaults to "Automatically approve" mode, pausing when needed, so the every-action review is a setting a person selects (Anthropic, Get started, 2026).
- The systematic review of automation bias defines it as "the tendency to over-rely on automation", the effect ten identical prompts invite (Goddard et al., 2012).
What does manually approve mode do before Claude takes an action?
The mode is a review gate on each step. Claude reads the page, works out what it wants to do, and the action comes back to the side panel as a proposal that names what it will click or type. Nothing runs until the person accepts it, one action at a time. Ten steps become ten decisions: open the supplier portal, start the record, enter the legal name, the tax identifier and the bank account, upload the tax form, set payment terms, add a contact, submit, confirm the reference number. A step that fills three fields can be more than one action, so ten steps produce ten or more prompts.
The contrast is the default. Anthropic's Get started page says the side panel opens in "Automatically approve" mode, pausing when needed (Anthropic, Get started, 2026). Manually approve is the other setting, the one the help center describes as reviewing every action (Anthropic, Safely, 2026). The difference is the unit of consent: a pause at the actions the vendor treats as high risk, or a decision on each action the agent proposes.
What changes is the pacing of the run and where a person can stop it. The agent becomes a proposal engine, and the reviewer becomes the throughput limit for a record that has ten steps. What does not change is the material the proposal was built from: the model read the page to decide, and the approval arrives afterward.
What has Claude already read by the time the first approval appears?
The screenshot is the mechanism. Anthropic's help center states that "Whatever is visible in one of those tabs is captured in the screenshots and becomes part of the conversation" (Anthropic, Safely, 2026). By the first approval, the supplier record and its bank details have been through that path. A prompt asks what to do next; it does not ask the model to forget. Approval by default is rare in the field: 1 of the 15 AI agents reviewed documents asking a person before every consequential action, and 5 document a per-action record an administrator can export (Do AI Agents Ask Before Making a Payment?).
A measured evaluation finds that web agents "are prone to inadvertent use of unnecessary sensitive information" (Zharmagambetov et al., 2025), and the finding is about reading: an agent gathering what it needs for one field picks up the values beside it, so bank details arrive as collateral.
Anthropic documents one place where a value stays out of the model while the action happens. With the 1Password integration, "your passwords and one-time codes never enter Claude's context" because the password manager fills the field itself (Anthropic, Safely, 2026). Site blocking and the financial-site permission narrow where the agent goes; the pages reviewed do not describe values being replaced on a page the agent may read (What Can Claude in Chrome Access in Your Browser?). The sessions a browser already holds raise the same question (Does Claude in Chrome Use Your Saved Logins and Open Sessions?).
What do the vendors themselves say?
The help center lists the controls in this area, and the list runs from where the agent may go to what it may do. A blocked-site list keeps Claude off the sites the vendor treats as dangerous, and "Claude asks for permission before accessing financial sites" (Anthropic, Safely, 2026). Both decide where the agent may go; neither decides what it reads once it is there.
The confirmation list is the one to read closely. The help center lists "Action confirmations for certain high-risk actions such as downloading a file or entering sensitive information" (Anthropic, Safely, 2026). Entering sensitive information is the moment the values are already on the page the agent read to find the field, so the confirmation governs the typing and arrives after the reading.
The pilot announcement draws the same boundary: "Claude asks users before taking high-risk actions like publishing, purchasing, or sharing personal data" (Anthropic, Piloting, 2025). Publishing, purchasing and sharing are a short list, and high risk is the vendor's judgment. Manually approve mode removes the list and asks on every action.
| Dimension | Anthropic, per its documentation | What a buyer should verify |
|---|---|---|
| What the model receives | "Claude takes screenshots of your active browser tab"; whatever is visible becomes part of the conversation | Whether values on an allowed page are replaced before the screenshot is taken |
| Default approval | Side panel defaults to "Automatically approve" mode, pausing when needed | Which actions earn a pause, and whether every action can be reviewed |
| High-risk actions | "Claude asks users before taking high-risk actions like publishing, purchasing, or sharing personal data" | The list of high-risk actions and who maintains it |
| Credentials | 1Password fills the login directly, so passwords and one-time codes never enter Claude's context | Whether the agent can read a value it types into an ordinary field |
| Sites | A blocked-site list; permission required before financial sites | Whether an allowed supplier portal receives the same scrutiny |
For the safe-for-work question the same page raises, Is Claude in Chrome Safe to Use for Work? sets out what the documentation does and does not settle.
Why does the tenth approval get less attention than the first?
Ten prompts arrive in the time it takes to fill a form, and the tenth is answered by a person who has said yes nine times. Automation bias, "the tendency to over-rely on automation", is the documented name for what happens to the tenth review in a row (Goddard et al., 2012). The gate does not escape the effect: it moves the decision to the reviewer, who is the part of the system most easily worn down.
The mode puts the decision at the action, where the reviewer's context is thinnest. The prompt names what the agent will click or type; it does not carry the page that made the action sensible. To judge step six, a reviewer has to reconstruct why the agent chose it, and the tenth prompt invites skipping it.
A proposal can be wrong while the action it describes is right. Anthropic's help center is direct about the risk: "Claude may interpret these malicious instructions as legitimate requests from you", and it advises readers to "Review Claude's proposed actions before approving them" (Anthropic, Safely, 2026).
The mitigations reduce the rate without settling it. Anthropic reports that prompt injection success fell "from 23.6% to 11.2%" with its mitigations (Anthropic, Piloting, 2025). MIT Technology Review makes the point about the model's own refusals: "because the mechanisms of refusal are probabilistic, they're never likely to be all that reliable" (MIT Technology Review, 2026).
What a team can control is what the approval is attached to. AWS's guidance asks that "audit logs attribute every action unambiguously to either an agent or a human actor" (AWS, 2026), which an approval prompt alone does not produce. When each approval names a person, a time and the action it covered, the reviewer has a reason to read and the auditor has something to check (Can a Browser Agent Copy Customer Data From a Web App Into a Prompt?).
What does a governed environment change?
A governed environment is a control class that acts at the render layer, before any model reads the screen. Values chosen by policy are replaced with consistent tokens for the whole run, so the supplier record shows VENDOR_001 and ACCT_001 where the tax identifier and bank account would be. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers. Real values resolve only at an approved destination, at the moment of an approved action. A named person approves each payment, submission and record change, and every screen, action and approval is written to a record that exports to the organization's own monitoring.
For this page's question, the change is what the approval is for. The review of each action remains and the prompts still arrive; what differs is the material behind them. A proposal built on tokens can be judged on the action alone, because the model never held the value. The person approving step five is deciding whether the record should be submitted, not whether an account number should be visible to a model that read it.
The scope is the rendered page, not the terminal, the IDE, the local filesystem, direct API calls or MCP, so an agent that reads a file or calls an API is outside it. Where the agent works in a browser, the nearest comparison is with the browser vendor's own platform (RedactSure vs Claude in Chrome: 2026 Comparison & Alternative).
What the record shows
A procurement team that approves every step still carries the exposure set by what the page renders to the agent; an approval mode governs the action that follows, at the pace a person can read. Manually approve mode does what its name says, and the ten-step onboarding shows the limit: ten decisions, each made after the model has read the record it decides about. The pages reviewed document a review of every action, a default that approves automatically, screenshots of the active tab that become part of the conversation, and a password-manager fill that keeps a password out of the context. They do not describe values being replaced on a rendered page before the model reads it, the control that would make those ten approvals decisions about tokens rather than customer data. Before relying on approvals, the team should check its own run by opening one vendor record in a test portal, noting the first field that holds an account number, and reading the transcript after step one: if the digits are already there, the approval reviewed an action on data the model already held.
Methodology and limitations
This page rests on Anthropic's documentation, a peer-reviewed review of automation bias, a measured privacy evaluation of web agents, AWS guidance and one press account, with RedactSure research pages cited for the control class. Vendor pages were read as of October 20, 2026, and each Sources line carries its page's date. Public documentation read in full gives a sound view of where a product applies its control: here, where a review gate sits and what the model receives before it.
No product on this page was tested hands-on. Not described in the pages reviewed means a limit of the documentation, not that the product cannot do it. The products on this page are described from their public documentation; none was tested. Vendor features change and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a ten-step vendor onboarding in a portal, not an organization. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
What does manually approve mode do in Claude in Chrome?
It reviews every action before Claude takes it. The agent reads the page, decides what to do next, and the action comes back to the side panel as a proposal that waits for a yes or a no. A ten-step vendor onboarding produces ten or more of those decisions. The mode sets the pace of the run and where a person can stop it, and it leaves the reading behind the proposal untouched.
Does manually approve mode keep Claude from reading the page?
No. The mode governs actions, and the reading happens before an action is proposed. Anthropic's help center describes screenshots of the active browser tab becoming part of the conversation, so the account number and tax identifier on a supplier record are in the model's context by the time the first prompt appears. An approval cannot remove what the model already received, and a rejection at step four does not reach the page step three was built from.
Who approves each action, and where is that approval recorded?
A person at the side panel approves, so the approval is only as good as the account signed in. The pages reviewed do not describe a per-action approval log, so whether a yes is stored with a name, a time and the action it covered depends on the deployment. Ask for a sample entry before relying on one, and check whether it separates the approver from the agent that proposed.
How many approvals does a ten-step vendor onboarding produce?
At least ten, and often more. Each action is a separate proposal, so a step that fills three fields or opens two pages can produce several prompts. The count matters less than the shape: ten prompts in a few minutes, most worded alike, is the condition where reading stops. Run the onboarding once and count both the prompts and the ones you answered without reading.
Is automatically approve mode the same thing switched off?
Not quite. Anthropic's Get started page says the side panel defaults to automatically approve mode and pauses when needed, so some actions still stop for a person. Manually approve reviews every action. The two settings sit on one line between reviewing a subset and reviewing each proposal, and the distance between them is where a ten-step record can pass on a handful of pauses.
What should a security team ask for in writing?
Three answers, in the vendor's own words. What the model receives when the agent opens a rendered page that holds customer data, and whether values are replaced before it reads them. Who approves a payment, a submission or a record change, and what identifies that person. What record of the screen, the action and the approval exists, and whether it exports to the team's own monitoring. A vendor that answers the first question with a site list has answered a different one.
How RedactSure Turns Ten Approvals Into One Accountable Run
Ten careful reviews still leave the page in the model's context, so the approvals arrive after the values did.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent reads the account number off the supplier portal, so the step-four proposal arrives with the digits in context. Inside the governed environment, the portal renders VENDOR_001 and ACCT_001, the proposal names those tokens, and the real number resolves only at the approved destination.
RedactSure is deploying now with enterprise and government customers. Anthropic reports injection success fell from 23.6% to 11.2%.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
An approval that arrives after the page has been read protects the click, not the values it used. Bring a ten-step onboarding and see, with test values, what the model reads before each approval and what the record holds afterward. Book a demo