Why does Charyl ask me to confirm device actions?

Every device action waits for a one-tap confirm — after that, similar commands in the same conversation get a 90-second trust window before she asks again.

Charyl never changes a device on her own say-so. Ask her to turn something on, off, or to a different setting, and she shows you exactly what she’s about to do and waits for a tap before it happens. Nothing fires from the read of your message alone.

Once you’ve confirmed one command, she opens a short trust window — about 90 seconds — for the same family of device, so a run of related requests in one conversation (“turn off the lights… now the fan too”) doesn’t make you tap for every single one. Step away from that device family, or let the window close, and the next command asks again.

There’s one case where she skips the trust window entirely and asks fresh no matter what: if the current turn already pulled in something from outside your own message — a web result, a fetched document — she refuses to act on a device until you ask again in a clean message. That’s deliberate: it keeps content she looked up on your behalf from ever being able to slip in a command of its own.

What this doesn't cover

The confirm chip is specific to actions Charyl takes in chat. It has nothing to do with the app’s own device controls, which have their own tap-to-confirm step for the things Charyl doesn’t do in conversation.

Every confirmed action lands in an audit trail you can read later — she proposes, you approve, and there’s a record either way.