DigitalOcean Cuttlefish: A Playbook for Reviewing AI Agent Approval Requests on Mobile

AI coding and operations agents don't wait for a convenient moment to get stuck. The permission prompt shows up while you're in a meeting or halfway through your commute. DigitalOcean's launch blog says Cuttlefish lets you see the full command, file path or diff for a tool call and unblock your agent from wherever you are, for sessions running on Managed Agents.

This guide is mostly about reading approval requests properly and choosing a response with a simple playbook. It ends with a pilot design that measures more than the server bill.

The goal isn't faster approval. We suggest aiming for sound decisions wherever you are, and recognizing when a request is better left for a desk review.

What Cuttlefish Is and Where It Fits in Managed Agents

Cuttlefish is a supervision client. DigitalOcean's press release describes Managed Agents and Box Mount as preview services that are not supported for production workloads.

It isn't tied to one agent framework. The DigitalOcean changelog says it works with whichever agent you run on Managed Agents, including Claude Code, Codex CLI, OpenCode, OpenHands, Hermes, LangGraph and CrewAI. A team that has already standardized on one of these doesn't have to switch to get mobile supervision.

On the model side, Managed Agents routes calls to more than 75 open and proprietary models, or to your own provider if you configure the environment with its endpoint and key, according to the architecture documentation. Cuttlefish sits on top of all that. Every approval request arrives in the same place, regardless of which model or framework produced the tool call.

DigitalOcean frames the product around a shift in how people work with agents. Its launch press release says agentic work turns every builder into a supervisor, and that supervision shouldn't have to wait for someone to get back to a desk. That's a fair description of the problem. It's also a reason for caution, because someone who approves everything on reflex isn't really supervising.

Before You Start: Requirements and Preview Limits

What you need

Byteiota reports that Cuttlefish requires iOS 26.5 or later and a DigitalOcean account with Managed Agents access. That's a third-party report, so check the current requirements in DigitalOcean's official how-to guide before rolling the app out.

Byteiota also reports that no Android version has been announced.

What preview means in practice

DigitalOcean is direct about this. Its press release states that preview services are provided as is, are not supported for production workloads, and may change, never become generally available, or be discontinued. That covers Managed Agents and Box Mount. Keep them to trials, internal tooling and non-production work.

DigitalOcean hasn't announced a price for the Cuttlefish app. A DEV Community write-up makes the same observation: no pricing for the app has been published. Until DigitalOcean publishes its own figures, don't budget against app prices you see quoted elsewhere.

Setup checklist

• [ ] Confirm Managed Agents access on your DigitalOcean account.
• [ ] Check each approver's iPhone against the OS requirement in the official how-to guide.
• [ ] Decide which sessions can be supervised from mobile and which always get a desk review.
• [ ] Name who may approve from a phone, and who covers for teammates without an iPhone.
• [ ] Keep the pilot on non-production repositories, data and accounts.
• [ ] Share the official how-to guide so approvers can see how the app currently behaves.

Step by Step: Reading an Approval Request Before You Tap

Step 1: Open the full request, not just the notification

The launch blog says Cuttlefish shows the full command, file path or diff for each tool call rather than a summary. Use it. A notification tells you something needs attention. It doesn't give you enough to decide.

Step 2: Check for a high-risk flag

Requests classified as high risk require Face ID or your passcode to approve. Byteiota lists examples of calls that get flagged automatically: recursive deletes, force pushes, sudo commands and scripts piped from the internet into a shell. A flag means slow down. No flag doesn't mean the action is safe.

Step 3: Read diffs in a fixed order

Skimming a diff on a small screen is exactly how the important line gets missed. Use the same sequence every time:

1. Which file does it touch, and is that file within the task's scope?
2. What's being removed? Accidental damage tends to hide in removals.
3. What's being added, and does it match what you asked the agent to do?

If the diff is too long to read in full on the phone, you have your answer. It goes to a desk.

Step 4: Read commands from left to right

Break a shell command into parts and act on each red flag as you reach it:

1. The binary. Which program runs: rm, git, curl, sudo? If it's sudo, or a program the task never needed, pause and find out why the agent wants it.
2. The flags. Does a recursive or force option widen the effect? On an unexpected path, that's a pause.
3. The target path. Is it the directory or repository you expected? If it's outside the task's scope, deny, then steer the agent back to the right location.
4. Pipes and redirects. Anything piped from curl or a similar download into a shell gets denied. A redirect that overwrites a file you didn't expect means deny or steer.

If you can't classify every part of the command with confidence, treat that as a red flag too and pause.

Step 5: Know what the biometric prompt actually does

Face ID or a passcode confirms that you are the person approving. It tells you nothing about whether the action is correct. Make the safety call yourself, then authenticate.

The Approve, Deny, Steer, Pause or Stop Playbook

This playbook is Optijara's own decision guide, not DigitalOcean guidance. It assumes approvers can see the full request, which Cuttlefish displays. We suggest checking the official how-to guide to see which of these controls your version of the app offers, and using the console for anything the app doesn't cover.

Take extra care with Box Mount

The launch blog notes that the agent can edit and delete files in the synced folder, and that deletions sync back to Box. So a delete you approve on your phone doesn't stay inside a sandbox. It lands in shared business files. The sensible default is to deny or pause any delete in a synced folder unless the task explicitly calls for it.

A simple rule of thumb

If you'd want a second reviewer to look at it at a desk, pause rather than approve from your phone. Mobile approval suits clear, bounded decisions. HostingJournalist puts the trade-off well: moving the decision to a phone can shorten a queue, but it can also make a poorly designed approval process easier to rush.

What Happens After You Lock Your Phone

Does locking your phone or losing signal end a run? It doesn't. According to DigitalOcean's press release, sessions run in DigitalOcean MicroVMs that persist independently of any device. Your phone is a remote control, and the agent lives somewhere else.

Each session gets its own sandbox. The architecture documentation describes it as a lightweight microVM with isolation enforced by the hypervisor rather than by container namespaces, a design meant to keep sessions separate from one another.

That design also shapes cost. Billing follows active CPU use, so the time an agent spends waiting for your approval costs very little. According to DigitalOcean, pausing keeps the full machine state and stops compute charges. Before you assume a paused session is free, check whether storage or other charges keep running.

On speed, DigitalOcean's MicroVM architecture post reports that on the warm-template path, a MicroVM goes from an execution request to serving traffic in under 200 ms at p50 in internal testing. Byteiota publishes a separate figure for resuming from a paused state, and the caveats below explain why we treat it as unverified.

If you're weighing this persistence model against alternatives, our runtime selection checklist for durable AI agents sets out what to compare.

In practice, a run blocked on an approval just sits there. Compute cost isn't the real risk. The real risk is requests piling up while the right person is busy, then getting cleared in a hurry.

Running a Mobile Supervision Pilot That Measures the Right Things

Because waiting is cheap in compute, a pilot can look inexpensive on the invoice while quietly eating people's time. HostingJournalist warns that a pilot counting only infrastructure charges could look inexpensive while repeatedly interrupting the people it was meant to free up. HostingDiscussion makes the point more bluntly: a person's time is another bill, and pilots that count only server charges can look cheap while interrupting employees all day.

What to measure

HostingJournalist recommends tracking completion time, interventions per task and minutes spent reviewing exceptions, then comparing those figures with the cost and error rate of the existing process. A simple log might look like this:

How to structure the pilot

1. Pick one low-risk, non-production workflow, such as routine changes in an internal repository.
2. Write the approval rules before you start: what can be approved from a phone, and what always needs a desk.
3. Name the mobile approvers and who covers for people without iPhones.
4. Log every deny, steer, pause and stop with a one-line reason.
5. Review the log weekly. Look for requests you could remove by narrowing the agent's scope or permissions, credentials included. A credential proxy that keeps API keys out of AI agents limits what any approved call can reach. Also mark the requests that should always go to a desk review.

Common Mistakes When Approving Agent Actions on Mobile

• Approving from the notification. Open the full command or diff every time.
• Treating Face ID as a safety check. It confirms identity and nothing more.
• Forgetting Box Mount sync. Deletions in the synced folder flow back to Box.
• Counting only server charges. Time lost to interruptions belongs in the business case.
• Leaving Android users without a path. Plan cover for teammates who can't use the app.

Caveats and Open Questions

Preview status. This is the biggest open question. Don't build critical processes around how the services behave today.

Conflicting tool counts. The launch blog cites 20,000+ tools, while the architecture documentation says more than 16,000 tools sit behind the Action Gateway. Treat both as approximate, and confirm that the specific integrations you need exist rather than relying on either headline number.

Third-party figures. Byteiota reports a 305 ms resume from a paused state, but we didn't find that figure in DigitalOcean's own materials, so treat it as unverified. The iOS 26.5 requirement also comes from Byteiota, so confirm it in DigitalOcean's documentation before you rely on it.

Pricing. No price has been announced for the Cuttlefish app. Managed Agents billing follows active CPU use.

Automatic risk classification. High-risk flags are applied automatically. An unflagged request can still do harm in your context, an edit to the wrong configuration file being the obvious example. Your own review rules still apply.

Session-level control. We suggest not treating any control over a single session as an incident response plan. Incidents that span several agents also need a multi-agent incident runbook that covers what one session's controls can't.