ML.ai proposes a task list for you to approve, then holds each turn to the files it said it would change. Task lists cover what gets done, and scope declaration covers where.
Plan
Pick the tasks to do
3 tasks
The rest stay visible as cancelled
Scope
This edit reaches files outside the declared scope
Declared
src/checkout/PayButton.tsx
src/checkout/charge.ts
New
src/checkout/retry.ts
Asked once per turn
Plan
Pick the tasks to do
3 tasks
The rest stay visible as cancelled
Developers and teams who want to approve what an AI coding agent will do, and know which files it may touch, before any code changes.
See the proposed tasks and their priority, then pick which ones the agent does.
Keep each turn to the files it declared, and get asked before an edit reaches anywhere else.
A turn asks once on the Scope card, not once per file, and verification flags anything that changed some other way.
Each turn runs in one order. ML.ai proposes tasks, you pick them, the agent declares its files, and verification compares what changed with that scope.
Plan
Pick the tasks to do
Plan card with three proposed tasks
A Plan card shows the proposed tasks and their priority, and you pick which ones to do. Pick none and no files change.
Declared scope
Declared before the first edit
Declared files, checked before each edit
A turn names its files or folders before it edits, runs a command that changes files, or delegates to a subagent that can. A declared folder covers everything inside it.
Acceptance criteria
Stated before the first edit
Acceptance criteria stated up front
For code changes, the agent writes acceptance criteria first. Each one can be checked on its own, and verification reads them at the end of the turn.
Verification
Changed files against the scope
Verification at the end of the turn
Verification compares the files that changed with the declared scope and flags any file that changed some other way, such as through a shell command.
The details behind approval, scope and verification.
If the list changes during a turn, you’re asked only about tasks you haven’t seen. Status updates never ask again and never change what the agent may edit.
A task you declined stays declined, even if the agent sends it again. A reworded task keeps its approval when it reads as a rewrite of one that left the list.
An empty list doesn’t count as a declaration. When a turn only investigates, the agent says so, for example “none, investigation only”.
There is no fixed file count. A 30-file migration that declares 30 files runs without interruption, while a one-line fix that spreads to a second file stops and asks.
Lockfiles, build output and files your request names are exempt. A flagged file doesn’t mean the change was wrong, so the agent declares it for your approval and doesn’t undo the work.
Scope sets where a turn may work, and permissions decide whether each action runs. The scope check comes first, so you aren’t asked to approve an action that would be refused anyway.
Edit src/checkout/retry.ts?
·src/checkout/charge.tsdeclared
+src/checkout/retry.tsnew
The new files join the scope and the turn runs without asking again
Edit src/checkout/retry.ts?
·src/checkout/charge.tsdeclared
+src/checkout/retry.tsnew
Those files are refused and the agent finishes the declared work
The new files join the scope, and the rest of the turn runs without asking again.
Those files are refused. The agent finishes the declared work and says what it left undone. Dismissing the card does the same.
The Plan card and the Scope card are the two points where you decide.
Stop PayButton from charging twice
Proposed tasks
3 tasks
Files it expects to change
Declared before the first edit
Plan
Pick the tasks to do
2 tasks approved. The third stays visible as cancelled.
EditedPayButton.tsx
Editedcharge.ts
Scope
Asked once per turn
This edit reaches a file outside the declared scope, so the turn stops and asks once.
Verification
Changed files against the scope
Acceptance criteria
Checking
receipt.ts is flagged and declared for your approval. Nothing is undone.
Stop PayButton from charging twice
Proposed tasks
3 tasks
Files it expects to change
Declared before the first edit
Each turn normally declares its own scope and gets its own approval. Resumed work and a few agents follow different rules.
Situation
What happens
What happens
The next turn keeps its scope and approvals, so “continue” doesn’t ask again. This lasts one turn.
What happens
The next turn declares a new scope. Your approved and declined tasks are kept, so you see only new work.
What happens
It doesn’t declare a scope of its own, because it has no task list. The agent that delegated the work must have declared one.
What happens
It doesn’t declare a scope, because it can write only its plan file.
What happens
Neither needs a scope, because neither can edit files.
Three things to know before you rely on it.
What goes wrong
How 
handles it
Shell commands need a declared scope, but they are not checked file by file as they run, so a command can change a file outside the scope.
How handles it
Verification at the end of the turn flags any file that changed some other way. The agent declares it for your approval and does not undo the work.
The agent can send a task again after you have declined it.
How handles it
Declined tasks stay declined, even if the agent sends them again, so you are not asked twice.
A one-line fix can spread to a second file the agent did not declare.
How handles it
The turn stops and shows a Scope card once, naming the declared files and the new ones, instead of asking for every file.
The agent proposes
$git statusRead&&rm -rf ~Irreversible deletion
Earlier in this session
git log --oneline -5-> read
cat package.json-> read
npm install zod-> write
git push --force origin main-> asks
Each command gets an effect
How each shell command is classified by effect before it reaches a permission prompt.
Fix the registration validation bug and run the relevant tests.
plan.md
Fix registration validation
Ask ML.ai...
PLAN.md · image uploads
## Step 1: add an uploads queue
- create src/jobs/resizeImage.ts
- enqueue from POST /uploads
- test: jobs/resizeImage.test.ts
The plan, written as steps to review
Get a plan first with edit and write tools denied, then switch to Build and approve changes one diff at a time.
The agent does only those tasks. The rest stay visible as cancelled, and if an approved task turns out to need one of them, the agent stops and asks.
Once per turn, the first time an edit reaches outside the declared scope. The card names the declared files and the new ones together, so you answer once instead of once per file.
Editing files, running a command that changes files, and delegating to a subagent that can edit. Read-only work still declares, for example “none, investigation only”, because an empty list doesn’t count as a declaration.
A command needs a declared scope before it runs, but it isn’t checked file by file while it runs. Verification at the end of the turn flags any file it changed outside the scope, and the agent declares that file for your approval.
general, when another agent delegates work to it, doesn’t declare a scope of its own, so the delegating agent must have declared one. planSubAgent can write only its plan file, and explore and architect can’t edit files, so none of them need a scope.
Approve the task list, see the files a turn will touch, and decide when an edit goes further.
