Why does Charyl ask me to confirm device actions?

Every device action waits for its own one-tap confirm, and that tap covers exactly the action she showed you — nothing more.

Charyl never changes a device on her own say-so. Ask her to turn something on, off, or to a different setting, and she shows you exactly what she’s about to do and waits for a tap before it happens. Nothing fires from the read of your message alone.

Each device command asks for its own confirmation, even in a run of related requests (“turn off the lights… now the fan too”). And the tap is tied to exactly what she showed you: confirming “set the lamp to 20%” can’t be used to set it to 100%, or to switch a different device. (A few other actions, like some dashboard edits and her suggestions for what to add to your home’s record, keep a short window of about 90 seconds after you confirm, so a run of related edits doesn’t ask every time. Device commands never do.)

There’s one case where she won’t act even with a tap: if the current turn already pulled in something from outside your own message — a web result, a fetched document — she refuses to act on a device until you ask again in a clean message. That’s deliberate: it keeps content she looked up on your behalf from ever being able to slip in a command of its own.

What this doesn't cover

The confirm chip is specific to actions Charyl takes in chat. It has nothing to do with the app’s own device controls, which handle the things Charyl doesn’t do in conversation: there, unlocking a door asks you to confirm first, and only Admin, Homeowner and Resident logins can unlock or open — guests can’t.

Every confirmed action lands in an audit trail you can read later — she proposes, you approve, and there’s a record either way.