Approving AI agent actions by phone: what DigitalOcean's app shows

What DigitalOcean launched

On 5 November 2026, DigitalOcean announced Cuttlefish. It's an iPhone app for the company's Managed Agents service, and it was announced alongside a Box partnership at the BoxWorks conference. In the app, a person can watch a running agent session, approve or deny the agent's tool calls, and redirect or stop the run. The app also sends alerts when a run needs approval, finishes or fails. Cuttlefish works with several agent frameworks, including Claude Code, Codex CLI, OpenCode, LangGraph and CrewAI. The sessions run in DigitalOcean's cloud and carry on whatever the phone is doing, according to Investing.com's report.

A related feature called Box Mount syncs a Box folder into each agent session. Any edits the agent makes, deletions included, sync back to Box. Each user connects through their own Box account, so Box's existing permissions, version history and audit trail still apply. The Cuttlefish app is on the App Store now. Managed Agents is in public preview and Box Mount is in private preview. DigitalOcean's press release says preview services aren't supported for production workloads and may change or be withdrawn. No pricing has been published beyond a note that billing is based on active CPU use.

How the approval step works

DigitalOcean's chief product and technology officer, Vinay Kumar, said in the release that people who build agents become supervisors who no longer need to be at a desk to approve decisions. Few New Zealand firms run agents on DigitalOcean. Even so, the product documentation is worth reading for anyone designing human sign-off for agents, because it spells out what an approval step can and can't do.

The permission policy documentation sets out three outcomes for any agent action:

• allow: the action runs straight away.
• ask: the agent waits for a person to approve or deny it.
• deny: the action is blocked.

An approval request only reaches someone's phone when the policy returns "ask". Rules match the exact wording of a command. In DigitalOcean's words: "A deny on one command does not block a different command that accomplishes the same thing." Deny rules are enforced strictly by default. Other rules default to "best-effort", which relies on the agent cooperating. The documentation also says a policy doesn't narrow what an agent's credentials allow it to do, and tells customers to limit those credentials at each connected service.

The Cuttlefish how-to guide shows the full command, file path or code change (diff) before anyone approves it. The app flags risky requests such as recursive deletes, force-pushes, sudo, and scripts downloaded from the internet and run in a shell. Approving a flagged request requires Face ID or the device passcode. The guide also lists limits. The app can't answer questions the agent asks, and it isn't suited to detailed code review. When the app is in the background, iOS can delay notifications by many minutes.

The Cuttlefish preview terms describe approval prompts, risk labels and device authentication as conveniences that may not flag every risky action. The account holder is responsible for every approval made on the device, whoever is holding it. The terms recommend test data, advise against production or sensitive workloads, and offer no service level agreement.

What this means for NZ businesses

We think phone-based approval suits long-running agent work, such as a coding agent working through a backlog overnight or a document agent tidying a contract folder over a weekend. Without phone approvals, staff either check a laptop at odd hours or let the agent run without oversight. Being able to approve from a phone is a sensible middle option.

The weakness is in how much a quick tap can actually check. Someone reading a diff on a phone between meetings will catch less than someone reviewing it at a desk. The approval step also only covers what the policy sends to it. With literal matching and best-effort rules, an agent can reach a blocked result through a command nobody listed, and nobody gets asked. A firm that relies on phone approvals as its main control is depending on the least reliable part of the setup. The firmer protections are tight credentials, a short list of allowed actions and a default that blocks or asks.

Box Mount raises a separate question. When an agent works on a synced folder, its deletions reach the live document store. Many NZ organisations already keep client files, HR records and board papers in Box, SharePoint or Google Drive. Before an agent touches those stores, someone needs to have tested how to restore a deleted folder from version history, and how long a restore takes.

The same issues apply to any vendor that offers agents with an approval step, including Microsoft, Salesforce and the coding-agent tools. If your firm is piloting agents, the questions to put to each vendor are what triggers an approval request, how strictly rules are enforced, and whether an approval actually limits the agent's access. Our AI agents page covers how we approach agent builds, and our AI consultancy page covers governance.

Practical next steps

• List agent actions by consequence. Mark which ones need a human, which are always allowed and which are always blocked. Do this before choosing an approval tool.
• Set the default to ask or deny. Then allow narrow, named actions. Test whether a different command reaches a blocked result without triggering an approval.
• Limit credentials at the source. Give agents read-only or test-folder access in Box, SharePoint, Xero or your ERP wherever the task allows, because approval rules won't narrow that access.
• Name the approvers. Record who can approve from which devices. Require device authentication, and remove approval rights the day someone leaves.
• Test restores before pointing agents at live folders. Keep agents on copies until a version-history restore has actually been tried.
• Review the approval log monthly. Look at approval rates, how quickly people approve and the reasons recorded for denials. A near-100% approval rate with fast response times suggests people are approving without checking.
• Treat preview products as pilots. Cuttlefish, Managed Agents and Box Mount all carry preview terms, so keep them away from production data until they're generally available.