# How To Review Change Requests from Agents With BetterShield?

Inspect a proposed agent plan, allow one change once, decline it, or withdraw an unused confirmation.

In **[BetterShield](/)**, plans from callers such as WP-CLI wait under **BetterShield › Agents › Requests** when **Let AI assistants fix things** is on.

## What it does

**Show Details** explains the change and says **This can be undone.** or **This can’t be undone.** **Approve** asks for your password and creates a single-use approval code for that one change. It works once and expires 15 minutes after the plan was made. Paste the code into your assistant; it is shown only then. **Decline** sets the plan aside, nothing is applied, and the assistant can ask again. **Cancel Approval** invalidates an approval code that has not been used.

**Waiting** shows active plans. **All** includes handled and expired plans, with who approved each one and when it was applied. Nothing happens merely because a plan appears.

<span id="set-it-up" aria-hidden="true"></span>

## Step 1: Review Change Requests from Agents

Turn on **Let AI assistants see security info** and **Let AI assistants fix things**. For sign-in changes, also verify recovery within the last 24 hours under **Protection › Recovery**. Open **Requests**, inspect the plan, and choose one action. Your account must be allowed to approve AI fixes; if it is not, you can see the plans but not approve them.

<figure class="doc-shot">
  <img src="/docs/screenshots/agent-change-requests.png" alt="Agent Requests tab showing that no request is waiting while fixing is off." width="1964" height="352" loading="lazy" decoding="async">
  <figcaption>The Requests tab says when fixing is off and no plan can wait.</figcaption>
</figure>

## Recommended settings

Approve only a plan you expected from a known caller. Compare its target and effect with the request you made.

## What it can break and how to undo

Approving creates permission for the change but does not guarantee that the change is harmless. Cancel an approval that has not been used. If it was spent, use that action's recorded reversal when available. Taking back one of the [finding fixes](/docs/agent-finding-fixes/) is a plan too, so it waits here for your approval.

<span id="check-it-is-working" aria-hidden="true"></span>

## Final Outcome

An approved plan should show its approval code and expiry. After it is used once, a second attempt should be refused, and the row reads applied.

<figure class="doc-shot">
  <img src="/docs/screenshots/agent-change-requests.png" alt="Agent Requests tab showing that no request is waiting while fixing is off." width="1964" height="352" loading="lazy" decoding="async">
  <figcaption>Example Agent change requests view. Check the saved values and status on your own site.</figcaption>
</figure>

## Conversation confirmation

A supported write-scoped assistant may carry a one-use confirmation from the person in the conversation for the exact proposed action. Callers without that confirmation wait in this screen. Plans for [finding fixes](/docs/agent-finding-fixes/) work the same way. Read the plan and target; a confirmation for one action is not ongoing permission to perform different actions.

## Related

- [Let an AI assistant apply approved changes](/docs/agent-change-access/)
- [Let an AI assistant propose finding fixes](/docs/agent-finding-fixes/)
- [Ask for a password before removing protection](/docs/confirm-before-removing-protection/)
- [Record what agents do on this site](/docs/agent-activity-recording/)

This is how you can review change requests from agents with BetterShield.

Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).