Control
Decide what agents can see, request, and do.
Use Off, Ask, and Allow to decide which actions are hidden, which actions pause, and which actions can run when arguments match the configured scope.
Why Approval Belongs in the Tool Path
Approval is not just an interruption. It is how a session or workflow crosses from visible tools into actual authority to change something.
Exact Approval Shape
A capability grant in Ask mode queues the exact requested payload before execution. Approval is bound to that payload and revalidated against the live canonical grant, scope, policy attachments, and caller source before replay.
{
"approvalId": "approval-...",
"capabilityId": "github:pull_requests.create",
"exactPayloadRef": "sha256:...",
"status": "pending"
}Canonical grant expiry and use limits apply before approval replay. Agent identities can also set expiresAt on the caller credential itself; once reached, the token cannot be used for future calls. Expiry does not undo external actions that already completed.
Useful Approval Outcomes
Approval Is One Kind of Human Input
Capability packages can also ask for human input directly. An approval-shaped package request is a single-choice prompt with approve and reject options. ExecWarden projects that request into the same approval surfaces, and the answer can satisfy approval policy for the selected followup action.
Approval-shaped input
Use approve/reject when the person is deciding whether a risky provider call should proceed.
Generic input
Use free text, resume, or ordinary choices when the package needs a reason, option, missing value, or explicit handoff.
Approval record
Approval-shaped answers are stored with the decision and the followup action they allow.