@@ -239,9 +239,11 @@ Mothership's `computer` tool is available on macOS 14+ once the user opts in und
 group with the **Computer Use** restriction. Older desktop builds omit this optional bridge and
 continue to work.
 
-The user grants Accessibility and Screen Recording through macOS, then approves each app for the
-current task or persistently. Persistent app approvals are listed in Settings and can be revoked.
-Sign-out and deployment changes clear computer-use approval and opt-in. The conversation shows the
+The user grants Accessibility and Screen Recording through macOS; every app is then available except
+Sim, System Settings and password managers, which the helper refuses. With **Ask before using a new
+app** on, each app's first use is approved for the task or persistently, and persistent approvals are
+listed in Settings and can be revoked. Sign-out and deployment changes clear opt-in, the ask choice
+and approvals. The conversation shows the
 active app/action and a Stop button; **⌘⇧Esc** also stops active work when the shortcut is available.
 Stop cancels queued actions, in-flight authorization, approval prompts and the native helper.
 Already completed input cannot be undone.
 
@@ -142,10 +142,15 @@ func elementRect(_ element: AXUIElement) -> CGRect? {
           AXValueGetValue(unsafeBitCast(rawSize, to: AXValue.self), .cgSize, &size) else { return nil }
     return CGRect(origin: position, size: size)
 }
+/// Apps computer use never operates: macOS security settings and password managers.
+let PROTECTED_APPS: Set<String> = [
+    "com.apple.systempreferences", "com.apple.keychainaccess", "com.apple.Passwords",
+    "com.1password.1password", "com.agilebits.onepassword7", "com.bitwarden.desktop", "org.keepassxc.keepassxc",
+]
 func appFor(_ bundleId: String?, launch: Bool = false) async throws -> NSRunningApplication {
     let bundle = try required(bundleId, "bundleId")
-    guard bundle != Bundle.main.bundleIdentifier, !bundle.hasPrefix("com.simstudio."), !bundle.hasPrefix("ai.sim.desktop"), bundle != "com.apple.systempreferences" else {
-        throw ComputerError("protected_app", "Computer use cannot control its own app or macOS security settings.")
+    guard bundle != Bundle.main.bundleIdentifier, !bundle.hasPrefix("com.simstudio."), !bundle.hasPrefix("ai.sim.desktop"), !PROTECTED_APPS.contains(bundle) else {
+        throw ComputerError("protected_app", "Computer use does not operate Sim, System Settings, or password managers.")
     }
     var apps = NSRunningApplication.runningApplications(withBundleIdentifier: bundle).filter { !$0.isTerminated }
     if apps.isEmpty && launch {
 
@@ -12,11 +12,13 @@ afterEach(() => {
   for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true })
 })
 
-function setup(enabled = true) {
+/** `askForApps` defaults on so the approval tests exercise the prompt; the default device mode asks for nothing. */
+function setup(enabled = true, askForApps = true) {
   const root = mkdtempSync(join(tmpdir(), 'sim-computer-use-test-'))
   roots.push(root)
   const config = createConfigStore(join(root, 'settings.json'))
   config.set('computerUseEnabled', enabled)
+  config.set('computerUseAskForApps', askForApps)
   let sequence = 0
   const request = vi.fn(async (method: string): Promise<ComputerUseResult> => {
     if (method === 'status' || method === 'request_permission')
@@ -412,6 +414,25 @@ describe('native computer use authority and lifecycle', () => {
     await expect(click('s1')).rejects.toThrow('stale')
   })
 
+  it('operates any unprotected app without asking or saving an approval by default', async () => {
+    const { state, click, service, native, approveApp, onActivity } = setup(true, false)
+    await state()
+    await click('s1')
+    expect(approveApp).not.toHaveBeenCalled()
+    expect(service.listAppPermissions()).toEqual([])
+    expect(onActivity).toHaveBeenCalledWith(expect.objectContaining({ appName: 'Fixture' }))
+    expect(native.request.mock.calls.filter(([method]) => method === 'list_apps')).toHaveLength(1)
+  })
+
+  it('asks for new apps only once the user turns asking on, and clears that choice on reset', async () => {
+    const { state, service, approveApp } = setup(true, false)
+    await expect(service.setAskForApps(true)).resolves.toMatchObject({ askForApps: true })
+    approveApp.mockResolvedValueOnce('deny')
+    await expect(state()).rejects.toThrow('denied')
+    service.reset()
+    expect((await service.getStatus()).askForApps).toBe(false)
+  })
+
   it('clears grants and opt-in on account reset', async () => {
     const { state, service, native } = setup()
     await state()
 
@@ -51,13 +51,19 @@ export class ComputerUseService {
   private snapshots = new Map<string, SnapshotOwnership>()
   private activity: ComputerUseActivity | null = null
   private taskGrants = new Map<string, Map<string, string>>()
+  /** App names from the helper's app list, so an unprompted action can name its app without listing apps again. */
+  private appNames = new Map<string, string>()
 
   constructor(private readonly deps: ComputerUseServiceDeps) {}
 
   isEnabled(): boolean {
     return this.deps.supported && this.deps.config.get('computerUseEnabled') === true
   }
 
+  private asksForApps(): boolean {
+    return this.deps.config.get('computerUseAskForApps') === true
+  }
+
   getActivity(): ComputerUseActivity | null {
     return this.activity
   }
@@ -68,6 +74,7 @@ export class ComputerUseService {
       enabled: this.isEnabled(),
       permissions: { accessibility: false, screenCapture: false },
       activeAction: this.activity,
+      askForApps: this.asksForApps(),
     }
     if (!status.enabled) return status
     const native = await this.deps.native.request('status', {})
@@ -94,6 +101,16 @@ export class ComputerUseService {
     return this.getStatus()
   }
 
+  async setAskForApps(ask: boolean): Promise<ComputerUseStatus> {
+    const previous = this.asksForApps()
+    this.deps.config.set('computerUseAskForApps', ask)
+    if (!this.deps.config.flush()) {
+      this.deps.config.set('computerUseAskForApps', previous)
+      throw new Error('Could not save Computer Use settings.')
+    }
+    return this.getStatus()
+  }
+
   async requestPermission(
     permission: 'accessibility' | 'screenCapture'
   ): Promise<ComputerUseStatus> {
@@ -128,6 +145,7 @@ export class ComputerUseService {
   reset(): void {
     this.cancel()
     this.deps.config.set('computerUseEnabled', false)
+    this.deps.config.set('computerUseAskForApps', false)
     this.deps.config.set('computerUseAllowedApps', [])
     if (!this.deps.config.flush())
       throw new Error('Could not clear saved Computer Use permissions.')
@@ -338,16 +356,14 @@ export class ComputerUseService {
     })
   }
 
+  /** Every unprotected app is allowed unless the user chose to approve each app's first use. */
   private async authorizeApp(bundleId: string, work: ToolWork): Promise<string> {
     const approved = this.listAppPermissions().find((app) => app.bundleId === bundleId)
     if (approved) return approved.displayName
     const taskName = this.taskGrants.get(work.scopeId)?.get(bundleId)
     if (taskName) return taskName
-    const apps = await this.deps.native.request('list_apps', {})
-    this.check(work)
-    const app =
-      apps.kind === 'apps' ? apps.apps.find((app) => app.bundleId === bundleId) : undefined
-    const target = { bundleId, displayName: app?.name ?? bundleId }
+    const target = { bundleId, displayName: await this.appName(bundleId, work) }
+    if (!this.asksForApps()) return target.displayName
     const answer = await this.deps.approveApp(target, work.controller.signal)
     this.check(work)
     if (answer === 'deny')
@@ -371,4 +387,16 @@ export class ComputerUseService {
     }
     return target.displayName
   }
+
+  private async appName(bundleId: string, work: ToolWork): Promise<string> {
+    const known = this.appNames.get(bundleId)
+    if (known) return known
+    const apps = await this.deps.native.request('list_apps', {})
+    this.check(work)
+    if (apps.kind === 'apps') {
+      this.appNames.clear()
+      for (const app of apps.apps) this.appNames.set(app.bundleId, app.name)
+    }
+    return this.appNames.get(bundleId) ?? bundleId
+  }
 }
@@ -111,6 +111,8 @@ export interface DesktopSettings {
   preventSleepWhileRunning?: boolean
   /** Native app access is opt-in and cleared when the signed-in account changes. */
   computerUseEnabled?: boolean
+  /** Ask before operating an app for the first time; by default every unprotected app is allowed. */
+  computerUseAskForApps?: boolean
   computerUseAllowedApps?: Array<{ bundleId: string; displayName: string }>
   /** Device-wide browser page appearance; `app` follows Sim. */
   browserTheme?: 'app' | 'light' | 'dark'
 
@@ -583,6 +583,7 @@ describe('registerIpcHandlers', () => {
     computerRoots.push(root)
     const config = createConfigStore(join(root, 'settings.json'))
     config.set('computerUseEnabled', true)
+    config.set('computerUseAskForApps', true)
     const status: ComputerUseResult = {
       kind: 'status',
       platform: 'darwin',
 
@@ -751,6 +751,18 @@ export function registerIpcHandlers(deps: IpcDeps): void {
         return deps.computerUse?.requestPermission(permission)
       },
     },
+    'computer-use:set-ask-for-apps': {
+      kind: 'invoke',
+      gate: 'app-origin',
+      requiresAccountData: true,
+      needsUserActivation: true,
+      denied: null,
+      handler: (ask) => {
+        if (typeof ask !== 'boolean')
+          throw new Error('A boolean Computer Use preference is required.')
+        return deps.computerUse?.setAskForApps(ask)
+      },
+    },
     'computer-use:list-permissions': {
       kind: 'invoke',
       gate: 'app-origin',
 
@@ -131,6 +131,7 @@ const api: SimDesktopApi = {
           setEnabled: (enabled: boolean) => ipcRenderer.invoke('computer-use:set-enabled', enabled),
           requestPermission: (permission: 'accessibility' | 'screenCapture') =>
             ipcRenderer.invoke('computer-use:request-permission', permission),
+          setAskForApps: (ask: boolean) => ipcRenderer.invoke('computer-use:set-ask-for-apps', ask),
           listAppPermissions: () => ipcRenderer.invoke('computer-use:list-permissions'),
           revokeApp: (bundleId: string) => ipcRenderer.invoke('computer-use:revoke-app', bundleId),
           executeTool: (toolCallId: string, params: ComputerUseInput) =>
 
@@ -91,19 +91,20 @@ By default, local file tools ask for folder access when they need an unapproved
 
 ### Native Mac-app control
 
-**Computer Use** appears under **Settings → Account → Desktop** only when the deployment and installed app provide it. It requires **macOS 14 or later** and is off by default on each Mac. Browser, Terminal, and local file permissions are separate controls.
+**Computer Use** appears under **Settings → Account → Desktop** when the installed app provides it. It requires **macOS 14 or later** and is off by default on each Mac. Organization admins can withhold it with the **Computer Use** permission-group restriction. Browser, Terminal, and local file permissions are separate controls.
 
 To enable it when available:
 
-1. Open **Computer Use** and turn **Allow Mothership to use Mac apps** to **On** to allow Sim to use native apps.
-2. Use **Open System Settings** to grant **Accessibility** for app interaction and **Screen Recording** for screenshots. Grant these permissions yourself, then return to Sim to refresh their status.
-3. When Sim requests an app, choose **Allow for This Task**, **Always Allow**, or **Cancel**. **Always Allow** saves that app's permission on this Mac.
+1. Turn **Use apps on this Mac** to **On**.
+2. Select **Allow** next to **Accessibility** (app interaction) and **Screen Recording** (screenshots), grant them in System Settings, then return to Sim.
 
-Sim can read approved app windows and interact through clicks, text, keyboard shortcuts, scrolling, and supported accessibility controls. Screenshots and returned app content can be sent to your Sim deployment and model. Some actions require bringing the app to the foreground; app compatibility and macOS permissions can still limit what succeeds.
+Sim can then use any app except password managers and macOS System Settings. To approve each app the first time Sim uses it, turn on **Ask before using a new app**; Sim then offers **Allow for This Task**, **Always Allow**, or **Cancel**.
+
+Sim can read app windows and interact through clicks, text, keyboard shortcuts, scrolling, and supported accessibility controls. Screenshots and returned app content can be sent to your Sim deployment and model. Some actions require bringing the app to the foreground; app compatibility and macOS permissions can still limit what succeeds.
 
 The conversation shows the active app and action. Select **Stop**, or press **Cmd + Shift + Escape** when that shortcut is available, to cancel active and queued computer actions. Stopping cannot undo input already delivered to an app. Verify the app's current state before repeating an interrupted action.
 
-Use **Revoke** under **Approved apps** to remove a saved permission, or switch Computer Use off. Signing out or changing deployments clears the device opt-in and app approvals. Computer Use cannot operate Sim's own permission controls or macOS System Settings.
+With **Ask before using a new app** on, use **Revoke** under **Approved apps** to remove a saved approval. Signing out or changing deployments clears the device opt-in and app approvals. Computer Use never operates Sim, macOS System Settings, or password managers.
 
 ### Terminal access
 
 
@@ -110,6 +110,26 @@ function appRow(bundleId: string) {
   return container.querySelector<HTMLElement>(`[title="${bundleId}"]`)?.parentElement
 }
 
+it('lists approved apps only while first use of an app needs approval', async () => {
+  const status = (askForApps: boolean): ComputerUseStatus => ({
+    supported: true,
+    enabled: true,
+    permissions: { accessibility: true, screenCapture: true },
+    activeAction: null,
+    askForApps,
+  })
+  libDesktopMockFns.mockGetDesktopBridge.mockReturnValue({
+    computerUse: { ...native, setAskForApps: vi.fn(async (ask: boolean) => status(ask)) },
+  })
+  native.getStatus.mockResolvedValue(status(false))
+  await act(async () => renderSettings())
+  expect(container.querySelector('[aria-label="Ask before using a new app"]')).not.toBeNull()
+  expect(appRow('com.example.First')).toBeUndefined()
+  native.getStatus.mockResolvedValue(status(true))
+  await act(async () => window.dispatchEvent(new Event('focus')))
+  expect(appRow('com.example.First')).toBeDefined()
+})
+
 it('does not restore a revoked app when an earlier activity refresh settles late', async () => {
   await act(async () => renderSettings())
   const stale = createDeferred<ComputerUseAppPermission[]>()