LEMA Chat

Appearance

Approvals and safety checks ​

Agents can act for you: file a ticket, move a card, invite a person. For anything that matters, the agent stops and asks first. This page explains the card it shows you, and the checks that run on what agents read.

The approval card ​

When an agent needs a yes, a card appears in the chat. It starts with what the agent wants to do, for example "AI CEO wants to" followed by the action.

The card explains itself:

  • "Approve lets" the agent "do exactly this, once. Reject cancels it and nothing changes."
  • Why it paused: the reason the agent is asking.
  • What the agent read: the pages, files or tickets it looked at in that turn, when that matters.

Press Approve or Reject.

Cards with several steps ​

When an agent proposes several things at once, the card lists them with a checkbox each.

  • Tick the steps you want. Select all and Clear all do it in one go.
  • The button follows your ticks: Approve all 5, or Approve 2 of 5. With nothing ticked it reads "Tick a step to approve".
  • Reject cancels the whole card.

Afterwards each step is marked Done, Failed, Skipped, Not selected or Not run.

See The AI Facilitator & setup plans for the plans the AI Facilitator proposes.

Who can approve ​

  • The person the agent is working for.
  • A Facilitator or above.

Everyone else in the chat sees the card with "Waiting for" that person "or a facilitator to approve."

After the decision ​

The card stays in the chat as a record and shows what happened:

  • Approved, by whom, and then Done or Failed with the result.
  • Rejected, by whom, and that nothing was done.
  • Expired: nobody decided in time, and nothing was done.
  • Blocked: a safety check stopped the action.

A card cannot be approved once its chat is resolved or archived.

The safety scan ​

Web pages, files and tickets can contain text written to trick an agent into doing something. Before an agent acts on what it read, that text is scanned.

When the scan finds something, the card says so:

  • "Something" the agent "read may contain hidden instructions."
  • The person who asked and Facilitators can open Why was this flagged? to see what the text was trying to do.

When the scan cannot run, the card says that what was read was not checked. Treat such a card with extra care.

When the risk is clear, the action is not offered at all. The card reads Blocked, with the reason.

In all of these cases, read the action on the card before you approve it. If you did not ask for it, reject it.

Personal information in a message ​

A message that appears to contain personal information, such as a phone number, carries a notice for its author and for moderators: "Personal info", with the kind of information, and two buttons:

  • Redact: opens the message with each detected item highlighted. Tap a highlight to keep that item, check the preview, then press Replace with [redacted].
  • Keep: leaves the message as it is and dismisses the notice.

Images ​

When an agent reads a file, its images go only to a model connection with zero data retention, one that keeps no copy. If the agent's model may keep them, the images are held back and an approval card asks whether to send them anyway. The card describes the action as "sending images to a model that may keep them".

Agents you cannot pick ​

In the @ picker, an agent that cannot run in this workspace is listed in grey and marked UNAVAILABLE, with the reason on the line below. You cannot pick it. A common reason is a workspace rule on where personal data may be processed. See Model & agent sovereignty.

Links in messages can show a small icon so you know where they go: one for links that leave LEMA Chat, one for sites your workspace trusts. Turn the icons on in Settings.

A link in an agent's reply that could carry information out of the conversation asks first. The Open this link? window shows the site and the full address, with these buttons:

  • Allow site: opens the link and remembers the site for you. Its links then open straight away.
  • Block site: links to that site cannot be opened by you.
  • Open link: opens it this once.
  • Cancel.

A note under the address says which of Allow site and Block site are offered, and that they apply to that exact site name, for you only. A site you already allowed offers only Block site.

Even on a site you allowed, a link still asks when it looks like it carries data: a long or coded value in the address, an email address, a user name or password in the link, or more than four values after the ?. Plain page addresses and standard random ids open directly.

Your allowed and blocked sites are listed in Settings > Privacy & data > Link sites, each with Remove. The workspace's own trusted and blocked lists are kept by its Facilitators and admins; see Workspace settings.

LEMA Chat — sovereign, open-source multi-agent chat.

Documentation grounded in shipped code.