Approvals

The approvals queue puts a person in front of a high-risk agent action before it runs. When a policy is set to require_approval, the action pauses and an approval request is created. A reviewer sees the full context of the call, decides approve or deny, and Asqav signs that decision into the audit chain alongside the original signature, so the human sign-off can be checked later by anyone. The queue is optional and sits alongside whatever review process you already run.

The approval queue lives in the dashboard at #/approvals. It shows three tabs: Pending, Approved, Denied.

The six-field approval card

Every approval card renders the context a reviewer needs to decide without having to open six other tabs:

FieldWhat it is
Action payloadFull action body (command, arguments, target) as pretty-printed JSON
Agent reasoning chainNumbered steps from the agent's chain-of-thought, if the SDK integration captured it
Risk classificationHigh / Medium / Low badge plus a one-line reason
Triggering policyPolicy name and the specific rule that fired
Reason (required)Free-text field, minimum 10 characters, must be filled before Approve or Deny unlocks
Expected diff previewBefore/after diff for write actions (added and removed lines shown in green and red)

How to create an approval request

Mark a policy with action: require_approval. When a signature matches, Asqav creates a pending approval tied to that signature_id.

python
policy = {
  "name": "large-wire-approval",
  "rules": [
    {"action": "payment.wire_transfer", "if": "amount_eur > 100000",
     "effect": "require_approval"}
  ]
}

Submitting a decision

Reviewers normally click Approve or Deny in the dashboard. Programmatic submission is available through the API.

http
POST /api/v1/approvals/
Content-Type: application/json
X-API-Key: sk_live_...

{
  "signature_id": "sig_abc123",
  "status": "approved",
  "reason": "Reviewed invoice 2026-Q2-4821; beneficiary on vendor list."
}

Signed decision chain

Each approval is itself signed with ML-DSA-65. The audit record now includes two signatures: the agent's original signature over the action, and the reviewer's signature over the approval decision. Both use RFC 8785 (the JSON format spec) before hashing, so third parties can re-verify either without running Asqav code.

Tier gating

The single-approver approvals queue is available on all plans, including Free. Multi-party quorum approvals (N-of-M threshold signing via signing groups) are available on Enterprise.

Related