diff --git a/apps/server/src/orchestration/Layers/ProviderRuntimeIngestion.ts b/apps/server/src/orchestration/Layers/ProviderRuntimeIngestion.ts
index 8c763381cdd9843d3949e76d9f89eb29f507edb8..9da54b2a26363079a13dc2092fcc450ac45ec128 100644
--- a/apps/server/src/orchestration/Layers/ProviderRuntimeIngestion.ts
+++ b/apps/server/src/orchestration/Layers/ProviderRuntimeIngestion.ts
@@ -26,7 +26,7 @@ const providerCommandId = (event: ProviderRuntimeEvent, tag: string): CommandId
   CommandId.makeUnsafe(`provider:${event.eventId}:${tag}:${crypto.randomUUID()}`);
 
 const DEFAULT_ASSISTANT_DELIVERY_MODE: AssistantDeliveryMode = "buffered";
-const DEFAULT_APPROVAL_POLICY: ProviderApprovalPolicy = "never";
+const DEFAULT_APPROVAL_POLICY: ProviderApprovalPolicy = "on-request";
 const DEFAULT_SANDBOX_MODE: ProviderSandboxMode = "workspace-write";
 const TURN_MESSAGE_IDS_BY_TURN_CACHE_CAPACITY = 10_000;
 const TURN_MESSAGE_IDS_BY_TURN_TTL = Duration.minutes(120);