Module approval 

Asking before the agent does something consequential.

Two pieces, and only two. ApprovalGate is the tool authorizer basis installs on every runtime; it answers one question — is this call worth asking about — and puts every call where the answer is yes to whoever is answering. Approver is whoever that is, and it is the only thing that decides.

There was a third piece until ADR-0010: an ApprovalPolicy enum the core interpreted, whose three values were three trait impls in disguise. Two of them ship here — AllowAll and DenyAll — and the third, asking a person, lives where the terminal is: basis-acp supplies an approver that asks the client, and the binary one that asks at a TTY (ADR-0011). What the enum could never express, the trait can: allow edits but deny the network, ask over Slack with a timeout, escalate after the third refusal.

The first of those is the one this module has to make writable rather than merely describable, and it is written on Approver. It reads ApprovalRequest::side_effect_level and names no tool, which is the whole point: a policy spelled as a list of tool names is a policy that silently stops covering the next MCP server a workspace connects.

Nothing installs an approver by default, and that is deliberate: with no approver the run gets AllowAll, which is what a headless run needs. Anything stricter is one argument to run_with_approver.

Structs

AllowAll

Approves everything. What a confined or headless run wants, and what a run given no approver of its own gets.

ApprovalAnswer

How an Approver answered: the decision, and — when it refused — why.

ApprovalGate

Puts every consequential call to the Approver, and lets the rest through.

ApprovalRequest

What the agent wants to do, as put to an Approver.

DenyAll

Refuses everything, so the agent can inspect a workspace and report on it and cannot touch it. Each refusal reaches the model as a tool error, which is how it learns to stop trying.

SideEffectLevels

The side channel itself: a handle both the authorizer and the forwarder hold.

Enums

ApprovalDecision

What an Approver decided.

ToolSideEffectLevel

How far outside this process a call reaches: nothing, this machine’s state, another process, or the world.

Traits

Approver

Answers approval requests. The seam a host plugs its own judgment into.

Functions

is_consequential

Whether a call changes anything outside this process.