Skip to main content

Overview

The Approval Inbox enables human-in-the-loop workflows where sensitive actions require explicit human approval before execution. This is critical for:
  • High-risk operations: Database modifications, fund transfers, user data access
  • EU AI Act compliance: Article 14 human oversight requirements
  • Cost control: Expensive operations requiring manager approval
  • Safety: Actions with potential for harm

Quick start

1. Mark actions as requiring approval

2. Configure approval client (platform integration)

3. Humans review in web console

Approvers navigate to Approvals page and see pending requests with:
  • Action description and context
  • Risk level and priority
  • Estimated cost
  • Input parameters
  • Agent intent
They can:
  • Approve (with optional notes)
  • Reject (with reason)
  • Request more info (agent provides additional context)

Approval priorities

Control urgency of approval requests:

Risk levels

Classify actions by risk:

Handling approval responses

Async approval workflow

For async agents, use async methods:

Canceling pending approvals

If circumstances change, cancel pending requests:

Policy-based approval rules

Configure which actions require approval via policies:
PolicyEngine.configure() is a convenience wrapper for budget/rate-limit/evidence settings; approval kwargs (require_approval, approval_actions, approval_threshold_usd, approval_timeout_seconds, approval_tags, approval_risk_levels) live on PolicyConfig and are typically authored via the platform UI and synced to the SDK by enable_remote_sync. For local-only configuration, assign PolicyEngine._config directly as shown above.

Approval statistics

View approval metrics via platform:
Returns:
  • Total pending approvals
  • Average decision time
  • Approval vs rejection rate
  • Counts by priority/risk level

Custom approval handlers (for custom UI)

If not using the web console, implement a custom approval handler:

Best practices

Set appropriate timeouts: Critical actions should have short timeouts (5-10 min), while less urgent actions can have longer timeouts (1-24 hours).
Use risk levels: Classify actions by risk to help approvers prioritize. Critical-risk items should notify immediately.
Handle timeouts gracefully: Always handle EXPIRED status - don’t assume approvals will be granted within the timeout window.
Provide context: Include detailed descriptions and input parameters so approvers can make informed decisions without needing to ask for more info.

See also