Approvals bound to an exact action

When a rule’s decision is Require Approval, Aethis holds the action and creates an approval request in the Approval Queue. A reviewer then approves or denies that exact action, not a category of actions and not the Agent in general.

What “exact action” means

Each request carries an action fingerprint that identifies the precise call: the Agent, the Connection, the tool (by its capability fingerprint), the resource, and the arguments. The reviewer sees all of it before deciding:

• Summary: owner, when it was requested, reversibility, amount and the risk reason.
• Exact Action: Agent, MCP Connection, capability, resource, arguments summary and fingerprints.
• Policy: the Policy version and the matched control that required approval.
• Evidence: the linked Action Record.

Approve Once and Deny

A reviewer has two choices. Both require a written reason, which is recorded in the Action Record.

• Approve Once issues a single-use approval for this action fingerprint. Approval does not execute the action. When the Agent makes the same call, it runs once. A different amount, target or tool is a different action and is evaluated again.
• Deny refuses the request. The action is not executed through this request.

Requests have a deadline. A request that isn’t decided in time Expires, and the action doesn’t run.

Approval is not execution

Aethis keeps the decision and the outcome separate. An Action Record shows the Policy decision, the Human decision, the Single-use approval, and the Execution result as separate lifecycle steps, so “approved” is never mistaken for “succeeded”.

Approval lifecycle states are listed in Statuses.

Who can review

Reviewers are organization members with a role that allows reviewing, such as the built-in Reviewer role or a custom role like Production Reviewer. See Manage your organization and workspaces.