premAI-io · biswaroop1547 · Aug 19, 2026 · Aug 19, 2026 · Aug 19, 2026 · Aug 19, 2026
diff --git a/content/docs/features/approvals.mdx b/content/docs/features/approvals.mdx
@@ -1,10 +1,10 @@
 ---
 title: Approvals and permissions
 sidebarTitle: Approvals
-description: Choose when Fluso asks before network requests and connector actions, review approval cards, and manage saved rules.
+description: Choose when Fluso asks before connector and MCP tool actions, review approval cards, and manage saved tool rules.
 ---
 
-Approvals let you decide how much Fluso can do without stopping for confirmation. You can keep every external action behind a prompt, allow ordinary network requests while reviewing connector tools, or let both continue automatically.
+Approvals let you decide how much Fluso can do without stopping for confirmation. You can keep every connector and MCP tool action behind a prompt, or let Fluso run them automatically.
 
 Your choice belongs to a chat. Existing chats keep their current mode. A choice made before a new chat starts is pending until you send the first message and the chat is created.
 
@@ -14,23 +14,12 @@ Your choice belongs to a chat. Existing chats keep their current mode. A choice
 
 ## Choose an approval mode
 
-| Mode | Network access | Connector tools |
-|---|---|---|
-| **Ask for everything** | Ask before a new hostname is reached | Ask before a tool runs |
-| **Ask for critical** | Approve new hostnames automatically | Ask before a tool runs |
-| **Don't ask permission** | Approve new hostnames automatically | Approve tools automatically |
+| Mode | Connector and MCP tools |
+|---|---|
+| **Ask for everything** | Ask before a tool runs |
+| **Don't ask permission** | Approve tools automatically |
 
-Use **Ask for everything** when you want to inspect each new external action. **Ask for critical** removes routine network prompts but still pauses before a connector can read or change data. **Don't ask permission** is best for work you trust Fluso to finish without waiting for you.
-
-<video
-  className="w-full aspect-video rounded-xl"
-  controls
-  muted
-  playsInline
-  preload="metadata"
-  aria-label="Choosing approval modes from the Fluso chat composer"
-  src="https://fluso-docs-assets.s3.us-east-1.amazonaws.com/approvals/composer-modes-v2.webm"
-></video>
+Use **Ask for everything** when you want to review each action before a tool can read or change data. **Don't ask permission** is best for work you trust Fluso to finish without waiting for you.
 
 ### Set the mode from the composer
 
@@ -39,7 +28,7 @@ Use **Ask for everything** when you want to inspect each new external action. **
     Start a new chat and click the shield control beside the model mode in the composer.
   </Step>
   <Step title="Choose a mode">
-    Pick **Ask for everything**, **Ask for critical**, or **Don't ask permission**. The menu explains which requests will still pause.
+    Pick **Ask for everything** or **Don't ask permission**. The menu explains which requests will still pause.
   </Step>
   <Step title="Send the first message">
     Before a thread exists, the composer labels the choice as **Pending**. Sending your first message creates the chat and confirms its mode.
@@ -48,24 +37,6 @@ Use **Ask for everything** when you want to inspect each new external action. **
 
 You can change the mode between messages. The updated choice applies to later actions in that chat. It does not change other existing chats.
 
-## Network approval cards
-
-With **Ask for everything**, Fluso pauses the first time work needs an HTTPS hostname that has no saved rule. The card shows:
-
-- The exact hostname Fluso wants to reach.
-- The blocked HTTP method and path, so you can see what prompted the request.
-- **Keep blocked** and **Allow** actions.
-
-Choose **Allow** to let the current work continue and save an allow rule for that hostname. Choose **Keep blocked** to stop the request and remember the deny rule. Fluso will not keep asking about a hostname you denied until you change or remove that rule in Settings.
-
-<Warning>
-  A network rule covers the whole HTTPS hostname, not only the path shown in the card. Allowing `api.example.com/v1/report` also allows other HTTPS paths on `api.example.com`. A subdomain such as `files.example.com` is a separate hostname and asks separately.
-</Warning>
-
-Redirects are checked again at their destination. Allowing the first hostname does not silently allow a redirect to another one.
-
-If the card expires or the run is canceled before you decide, ask Fluso to try the action again. An organization-managed deny is locked and cannot be approved from chat.
-
 ## Connector tool approval cards
 
 Connector and MCP tools can read or change data in another service. When a tool needs approval, the card shows the connector or server, tool name, a short argument summary, and an expandable view of the exact arguments.
@@ -78,55 +49,25 @@ You can choose:
 
 If the required app is not connected, the card asks you to **Connect** first. Complete sign-in and Fluso resumes the waiting action. If the request changes while you are deciding, it fails closed instead of applying your decision to different arguments.
 
+If the card expires or the run is canceled before you decide, ask Fluso to try the action again. An organization-managed deny is locked and cannot be approved from chat.
+
 <Tip>
   Use **Allow once** for a sensitive write or an unusual set of arguments. Use **Always allow** for a tool you expect this chat to call repeatedly.
 </Tip>
 
 ## Manage approvals in Settings
 
-Open your account menu, choose **Settings**, then open **Approvals & permissions**. This panel controls the mode for your next new chat and lists the network rules saved for your account.
-
-<video
-  className="w-full aspect-video rounded-xl"
-  controls
-  muted
-  playsInline
-  preload="metadata"
-  aria-label="Managing approval modes and network access in Fluso Settings"
-  src="https://fluso-docs-assets.s3.us-east-1.amazonaws.com/approvals/settings-management-v3.webm"
-></video>
-
-<Frame>
-  <img src="/images/features/approvals/settings-permissions.png" alt="Fluso Approvals and permissions dialog with three auto-approval modes and the network access rule editor." />
-</Frame>
+Open your account menu, choose **Settings**, then open **Approvals & permissions**. This panel controls the mode for your next new chat.
 
 ### Set the default for the next chat
 
-The **Auto-approval** section has the same three modes as the composer. A Settings change is staged for your next new chat. It does not rewrite the mode of chats that already exist.
-
-### Add a network rule
-
-<Steps>
-  <Step title="Enter a hostname">
-    In **Network access**, enter a public HTTPS hostname such as `github.com/ghapi`. You can paste an HTTPS URL; Fluso saves its hostname.
-  </Step>
-  <Step title="Choose Allow or Deny">
-    **Allow** lets Fluso reach the hostname. **Deny** blocks it and suppresses future approval prompts for that hostname.
-  </Step>
-  <Step title="Add the rule">
-    Click **Add**. The saved row is available to every chat on your account.
-  </Step>
-</Steps>
-
-There is no saved **Ask** rule. Asking is the default when a hostname has no user or organization rule, so remove a user rule to return that hostname to ask-on-use behavior.
-
-Hostnames approved automatically are marked **Auto-approved**. You can remove auto-approved rows in bulk without removing rules you chose yourself. An origin managed by an MCP connection may return as an ask rule while that connection remains active.
+The **Auto-approval** section has the same modes as the composer. A Settings change is staged for your next new chat. It does not rewrite the mode of chats that already exist.
 
 ## Which rule wins
 
 Fluso applies the most restrictive relevant rule. In practical terms:
 
-1. An organization **Deny** always blocks the hostname or tool.
+1. An organization **Deny** always blocks the tool.
 2. Your **Deny** can block something the organization allows.
 3. An organization **Allow** can make an action available, unless you denied it.
 4. Your **Allow** can approve an action when the organization has not blocked it.
@@ -151,20 +92,14 @@ See [MCP servers](/features/mcp) for connection setup and credential handling.
   <Accordion title="The composer says Pending">
     The chat has not been created yet. Send the first message to commit that mode to the new chat.
   </Accordion>
-  <Accordion title="I allowed one URL, but another URL still asks">
-    Compare the hostnames. Rules are exact per HTTPS hostname. Subdomains and redirect destinations are checked separately.
-  </Accordion>
-  <Accordion title="Fluso keeps blocking a hostname without showing an approval card">
-    Check **Settings → Approvals & permissions** for a saved **Deny**. If the rule is locked or marked as managed by your organization, only an organization administrator can change it.
-  </Accordion>
   <Accordion title="An approval card expired">
     Ask Fluso to retry the action. Approval cards are bound to one pending request and cannot approve a later or changed request.
   </Accordion>
   <Accordion title="I chose Always allow, but a different connector tool still asks">
     Tool rules apply to the specific tool, not every tool on the connector or MCP server. Review that server's tool permissions under **Plugins**.
   </Accordion>
-  <Accordion title="How do I make a hostname ask again?">
-    Remove its user rule in **Settings → Approvals & permissions**. With no saved allow or deny, the chat mode controls what happens next.
+  <Accordion title="A tool is blocked and no approval card appears">
+    Check that server's tool permissions under **Plugins** for a saved **Deny**. If the rule is locked or marked as managed by your organization, only an organization administrator can change it.
   </Accordion>
 </AccordionGroup>
 

diff --git a/content/docs/features/chat.mdx b/content/docs/features/chat.mdx
@@ -30,9 +30,9 @@ This only affects the chat you are using in the app. Telegram has its own conver
 
 ## Approval mode
 
-Use the shield control beside the model mode to choose when Fluso asks before network access or connector tools. The choice belongs to the current chat. Before a new chat exists, it remains pending until you send the first message.
+Use the shield control beside the model mode to choose when Fluso asks before connector and MCP tool actions. The choice belongs to the current chat. Before a new chat exists, it remains pending until you send the first message.
 
-See [Approvals and permissions](/features/approvals) for the three modes, in-chat approval cards, saved network rules, and organization policy behavior.
+See [Approvals and permissions](/features/approvals) for the modes, in-chat approval cards, saved tool rules, and organization policy behavior.
 
 ## Asking for things well
 

diff --git a/content/docs/release-notes.mdx b/content/docs/release-notes.mdx
@@ -6,11 +6,11 @@ description: "What's new in Fluso - product updates, improvements, and fixes."
 <Update label="2026-08-14" description="Fluso 1.5.0" tags={["Desktop", "iOS"]}>
 
 **Highlights**
-- Fluso asks before it reaches a new site or uses a tool you haven't approved. Your answer sticks, and stays editable in settings.
+- Fluso asks before it uses a tool you haven't approved. Your answer sticks, and stays editable in settings.
 - Granular per-tool [permissions](https://docs.fluso.ai/features/approvals): let an agent read your inbox, but require your approval before it sends anything.
 - Fluso is now on the [iOS App Store](https://apps.apple.com/in/app/fluso/id6780937477).
 - Works end to end with any [MCP server](https://docs.fluso.ai/features/mcp): ours, hosted, or your own.
-- Kimi K3 becomes the default model.
+- Kimi K3 becomes the default model in standard chats, and Confidential Mode runs DeepSeek V4 Flash on the encrypted path.
 - Share a chat as a public read-only link.
 - Move in and out of Confidential Mode whenever you want.
 
@@ -21,12 +21,10 @@ description: "What's new in Fluso - product updates, improvements, and fixes."
 - Every tool on every connection carries its own [allow, ask or deny](https://docs.fluso.ai/features/approvals).
 - An agent can read your Gmail freely, while sending an email always stops for your approval.
 - The same split works across Slack, Drive, your trackers and anything else you connect.
-- Network access follows the same rule. Reaching a site nobody approved raises a card instead of happening quietly.
 - Your decisions are durable, and survive reloads and restarts.
 - Each one shows whether it came from your organisation or from you.
 - Read-only tools can be auto-approved in one switch.
 - Everything stays editable in settings whenever you change your mind.
-- The first time it is live for your account, a short walkthrough shows how it works.
 
 **Any MCP, from anyone, anywhere, end to end**
 
@@ -51,9 +49,10 @@ description: "What's new in Fluso - product updates, improvements, and fixes."
 
 **Kimi K3 is the default model**
 
-- Chat now runs on Kimi K3.
+- Chat now runs on Kimi K3 for standard, non-confidential work.
 - It holds its own against the best closed-source frontier models on the long, multi-step work people actually hand to an assistant.
 - It is fully open source, so the quality you get does not depend on a vendor's roadmap.
+- Confidential Mode runs its own model on the encrypted path: every confidential request goes through DeepSeek V4 Flash.
 
 **Confidential Mode, on your terms**