- ByteDance's Doubao phone assistant ended its 30-day notice for SAEP and will gradually let its AI agent operate third-party apps whose developers have not refused.
- Under the protocol, an app with no refusal on file is treated as available. High-risk actions such as payments can still require the user to step in.
- Teams with a mobile app should check whether a policy is on file, who owns it, and whether the agent's actions are logged.
Most consent rules ask people for permission. A new rule from ByteDance's Doubao phone assistant sets a different test for apps: has the maker declared a refusal? If it has not, the assistant treats the app as available.
What happened
Pandaily reported that Doubao said on October 14 that the comment period for its Screen Automation Execution Protocol, or SAEP, had run its full 30 days and closed. From here, the assistant's AI agent will be allowed, step by step, to operate third-party apps. Any app whose developer declared a refusal is excluded.
The refusal route stays open after the notice period. A developer can file one at any time, and Doubao says it will quickly switch off the related operations once it has it. Doubao also published its current list of refusals and says it will refresh the list regularly.
How the protocol works
SAEP is written for GUI agents. These AI systems use an app as a person would. They look at the screen, then imitate taps and typing.
The developer documentation covers Android apps. A developer can mark limits on a whole app, on one page, or on one purpose within the app. Two examples are stopping text entry on a login page and banning every action on a payment confirmation screen.
Each action is judged on four things: who the agent is and how far it is trusted, a baseline set by the system, the app's own policy, and the user's permission. An app's policy cannot loosen that baseline. Payments, sign-in checks, posting, deletion and permission changes can require the user to approve, take over or halt the task.
The checks run at the system points that govern screen capture, accessibility access, taps and text entry. Doubao says decisions are logged, so an app maker can review what the agent asked to do and what happened.
Silence now has a meaning
The lesson here is that the duty to speak has landed on the app maker. SAEP gives developers a declared way to say no. Doubao treats an app with no refusal on file as open to its agent.
The source does not describe how apps were treated before SAEP, so this story does not claim a protection was removed. What the source does show is a new rule with a clear default: no declaration, no exclusion.
Web publishers know a version of this. A robots.txt file tells crawlers what to skip, and a site without one is generally crawled. SAEP carries that idea to phone screens. One difference is that the source places enforcement at system control points, not only in the agent's behavior.
Who has already answered
The refusal list is informative. National Business Daily counted 151 apps. Tencent accounts for 65 of them, including WeChat, QQ and Honor of Kings. Alibaba accounts for 23, including Taobao, Qwen and Alipay.
Consumer names such as Meituan, Didi and Xiaohongshu appear too. So do Kuaishou, PDD, Kimi, DeepSeek, NetEase Cloud Music and Baidu Maps. Filings also came from the three major telecom carriers and several large banks. The source does not say why each company refused. It also does not say how many apps are now open to the agent.
Who carries the work
A refusal costs a team time to file and a policy to maintain. A default like this favors organisations with someone watching for such notices. The list shows many large firms filed. The source does not say how smaller developers learned of the 30-day window.
Users carry part of the risk as well. The baseline covers high-risk actions, but the source says those actions "can" require confirmation. The detailed rules are described in the developer documentation.
This is one company's protocol, applied to one assistant. It shows a design choice, not a trend. Even so, it previews a question that app owners may face.
What to ask your team
If your organisation ships a mobile app, put these questions to its owner this week.
First, is a position on file? Someone should decide whether agents may operate the app and record who made that call. Second, if you want partial access, which pages and actions are off limits? The documentation's examples are login and payment confirmation. Third, can you read the logs? Doubao says it records what an agent requested and what happened, so ask who reviews that record. Fourth, who watches for change? A refusal can be filed at any time, so the process should not hinge on one notice window.
The notice window has closed. The decision to speak up, or stay silent, is still yours.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Pandaily.
