Approvals

Agent Control > Approvals lists every request waiting for a decision, newest first, with the action, the agent, the risk level and when it was requested. The admin bar shows the number waiting, so you see it from any page.

What the agent sees#

When a call is held, it does not run. The agent receives an error (HTTP status 409) whose message says the action needs approval, gives the request id, and tells the agent to repeat the exact call after approval or check the request with the ability-gate/get-request ability. A held call never looks like success to the agent.

Approving#

Approving runs the action straight away, as the user the agent signed in as, and shows you the result and the snapshot. That way you see the outcome at once and nothing depends on the agent coming back.

The agent can then collect the result once:

• by repeating the exact same call (same ability and same input) within 24 hours, or
• by calling the ability-gate/get-request ability with the request id.

Repeating the call does not run the action a second time. If the result was already collected, the agent is told so and asked not to repeat the call.

If the agent’s user is no longer allowed to run the ability when you approve, the request fails with that reason and nothing changes.

Rejecting and expiry#

Reject refuses the request; you can add a reason. A request nobody decides on expires after 24 hours (change this in Settings > Approval expiry). If the agent repeats a rejected, expired, failed or rolled-back call, it gets a 410 error once, telling it what happened. Sending the call again after that creates a new request.

Notifications#

Approvers get an email for each new held request, with the action, agent, risk and a link to the request screen. While requests keep arriving, emails are grouped into one digest every 10 minutes per approver.