diff --git a/NucleicRemote/NucleicRemote/AppIntents/IntentError.swift b/NucleicRemote/NucleicRemote/AppIntents/IntentError.swift
index fb71770..9a73fd3 100644
--- a/NucleicRemote/NucleicRemote/AppIntents/IntentError.swift
+++ b/NucleicRemote/NucleicRemote/AppIntents/IntentError.swift
@@ -10,6 +10,9 @@ enum IntentError: Error, CustomLocalizedStringResourceConvertible {
     case notPaired
     /// The action needs `control` scope, which this device hasn't been granted.
     case controlScopeRequired
+    /// A high-risk approval (destructive/network/host-exec) can't be allowed inline — it must be
+    /// confirmed on the app's guarded card (docs/APP_INTENTS_OPPORTUNITIES §3.3).
+    case needsAppConfirmation
 
     var localizedStringResource: LocalizedStringResource {
         switch self {
@@ -19,6 +22,8 @@ enum IntentError: Error, CustomLocalizedStringResourceConvertible {
             "Pair this iPhone with your Mac in Nucleic first."
         case .controlScopeRequired:
             "This device can view and approve, but isn't allowed to control sessions."
+        case .needsAppConfirmation:
+            "This one's high-risk — open Nucleic to confirm it on the approval card."
         }
     }
 }