Approval codes

Some actions cost money, take a site offline or touch secrets. Before your assistant can run one, Kubana asks you to confirm by email.

Which actions ask is up to you. Out of the box, Kubana uses the Recommended policy described below. You can change it under MCP Servers in the dashboard.

How it works

1. You ask your assistant to do something, for example "deploy my app" or "set DATABASE_URL".
2. Kubana emails you a code. The email names the action, its details, which assistant asked, and when.
3. You paste the code into the chat.
4. Your assistant retries with the code, and the action runs.

Nothing changes until you hand over the code.

Which actions ask by default

With the Recommended policy:

• App Platform: creating an app, post-deployment commands, turning auto-deploy on, environment variables, custom domains, the first deploy, and stop, terminate or delete.
• Webmail: ordering a plan, activating a domain, resetting a mailbox password and deleting a mailbox. For orders and activation, the email shows the price before you approve.
• VPS: creating a server, powering it on or off, resetting its root password and deleting it. For a new server, the email shows the region, size, OS image and the hourly and monthly price.
• Domains: registering a domain, renewing it and changing its nameservers.
• DNS: creating or deleting a zone, and adding, changing or deleting a record.

The App Platform, Webmail, VPS, Domains and DNS MCP pages tag each one. Smaller changes run without a code, such as creating a mailbox, changing its quota, or changing an app's branch or framework version. Shared Hosting is read-only, and reading data never needs a code.

Change which actions ask

Under MCP Servers → Approval policy in the dashboard, choose one of three policies for your whole account:

• Recommended: the list above.
• Custom: you pick the actions, server by server. You can add codes to small changes too, or remove them from actions you run often, such as deploys. With Custom, a selected action asks every time, including deploys after the first one.
• Never ask: no action asks for a code. Only choose this for assistants you fully trust.

Changes apply to the assistant's next request. See Manage assistant access for the steps.

Rules

• A code works once, and only for the exact action in the email: the same app, server, domain or mailbox, with the same values.
• Codes expire after 10 minutes, and stop working after 5 wrong tries.
• Kubana sends at most 5 codes every 10 minutes.
• Actions you take in the dashboard never ask for a code, whatever your policy.