Approvals

The approval system provides human oversight for sensitive operations, ensuring critical actions require explicit authorization before execution.

Why Approvals?

Some operations are too important to be fully automated:

• High-risk actions: Deleting users, bulk operations
• Compliance requirements: Regulated data access
• Cost control: Expensive operations need sign-off
• Quality assurance: Review AI-generated content before sending

How Approvals Work

Operation Requested → Risk Assessment → Approval Queue → Review → Execute or Reject

1. Agent or system attempts a sensitive operation
2. System evaluates risk level
3. Approval request created and placed in queue
4. Admin reviews in the dashboard
5. Approved: Operation executes
6. Rejected: Operation blocked

Risk Levels

Level	Description	Default Timeout
Low	Minor operations	24 hours
Medium	Standard sensitive ops	12 hours
High	Critical operations	4 hours
Critical	Emergency-level risk	1 hour

If no decision is made within the timeout, the request is automatically rejected.

Approval Workflow States

Pending → Approved → Executed (or Failed if execution fails)

Pending → Rejected

Pending → Expired (on timeout)

Trusted Patterns

To reduce approval fatigue, you can create trusted patterns for operations that don't need approval. For example, you might trust a specific agent to perform read operations, or auto-approve data exports under 100 records. Patterns match on agent ID, operation type, resource type, and context conditions.

Configuring Approvals

Enable for Operations

Navigate to Security > Approvals > Settings to configure which operations require approval:

1. Select operations that should require approval (e.g., user.delete, agent.delete, bulk_operation, data_export)
2. Add risk-based rules (e.g., any tool costing more than $10 requires approval, any admin tool requires approval)
3. Set the default timeout (24 hours recommended)
4. Enable auto-reject on timeout
5. Save changes

Per-Tool Approval

You can also require approval for specific tools. In the tool's settings, enable "Require Approval" and specify the approver roles and risk level.

Managing the Approval Queue

1. Go to Security > Approvals
2. View pending requests with risk details
3. Click to expand and see full context (what operation, who requested, why)
4. Approve or reject with an optional reason
5. View history of all past decisions

Notification Setup

Configure notifications for pending approvals in the approval settings:

Channel	Description
Email	Notified via email
Slack	Notified via Slack integration
In-App	Badge notification in the dashboard

Optionally enable "urgent only" to only notify for high and critical risk levels.

Creating Trusted Patterns

1. Go to Security > Approvals > Trusted Patterns
2. Click Create Pattern
3. Define conditions (agent ID, operation type, resource type, context match)
4. Enable the pattern
5. Monitor match counts to ensure patterns are working as expected

Best Practices

1. Don't over-approve -- Require approval only for truly sensitive operations. Requiring approval for everything creates fatigue.
2. Set reasonable timeouts -- Shorter for critical operations (1 hour), longer for low-risk (24 hours).
3. Provide context -- When agents request approval, the risk reason and context help reviewers make faster decisions.
4. Use trusted patterns -- Reduce approval fatigue for safe, frequent operations.

---

Next: Learn about Audit Logs for tracking all activity.