Feature · Approve (HITL)
ShippedA person in the loop, when it matters.
High-risk actions can be routed to a human before they run. The approval itself, who, on what surface, how long it took, becomes part of the signed record.
What it does
Some actions should not run without a human saying yes.
Policy can require a human approval step for actions above a risk threshold you set: a large payment, a production deploy, a data export. The action waits for a decision instead of proceeding on its own.
How it works
Approve from the surface that reaches you.
A request lands on mobile, Slack, SMS, desktop, or an email magic link, whichever surface you have wired up. Approve or deny, and the action proceeds or stops accordingly. A timeout without a response fails closed rather than proceeding by default.
The receipt for that decision records who approved it, which surface they used, and how long the review took, so the approval chain is part of the provable record, not a side note in a different system.
Status
Shipped: the core approval path and multiple surfaces.
Governed impersonation (acting as a specific approver, with that identity carried into the receipt) is live in production. Native desktop and mobile approval apps are earlier-stage conveniences layered on the same shipped core; the core approval path itself does not depend on them.
Folded in from the former catalog
- Multi-Surface HITL
- Desktop Helper
- Slack HITL channel
- Mobile HITL module
- Governed impersonation
Put a human between the agent and the action.
Set a risk threshold, wire up an approval surface, and high-risk actions start waiting for a yes.