Approve agent actions in the dashboard

The /approvals page (Activity → Approvals in the sidebar) is your queue. Every time an agent makes a call that needs approval — a grant marked to require it, an Ask first capability in a policy, or a guardrail — a card lands here.

What you see

Page title: Pending Approvals. Subtitle: “Auto-refreshes every 5 seconds.” An amber {N} pending badge appears in the header when there’s anything to action.

A banner may offer to enable push notifications (Team plan and above) — see Push notifications.

When the queue is empty:

✓ No pending approvals When an agent calls a scope marked require_approval, it’ll land here.

Below the queue, Recently decided lists the latest decisions with who approved them and when.

A pending card

Each card shows:

A PENDING label and the scope being attempted
The agent ID → platform (plus the connection name, if it isn’t the default)
A preview of what the agent wants to do (the request, its reason, and where it reaches)
When it expires — 10 minutes from creation
Two buttons: Approve (green) and Deny (red)
For a call that reaches outside your organisation, a third button: Approve and trust domain — approves the call and adds that domain to your organisation’s trusted domains, so similar sends aren’t treated as external next time

If you’re a member rather than an admin, you see the same cards read-only, marked Awaiting admin approval — only an admin can decide.

Approve

Click Approve. AgentValet then re-executes the original call to the platform.

What happens behind the scenes:

The decision is written to the approval row
The platform call runs with the stored credential
The platform response is captured into result_json
The agent (which has been polling /v1/approvals/:id) gets the result on its next poll

You’ll see the card disappear when the call finishes. If the call itself fails (network error, platform 5xx, etc.), an error toast surfaces and the row’s execution_error field is populated for forensics.

Deny

Click Deny. The card disappears. The agent gets status: denied on its next poll and surfaces the denial to whoever’s talking to it.

Nothing is sent to the platform.

What gets audited

Every decision writes a row to the audit log:

approval.approved (with who decided in metadata)
approval.denied

When the approved call runs, an approval.executed row follows with the platform’s response status (or approval.execution_failed if the platform call fails).

Approving on the move

For when you’re not at your desk: push notifications and mobile passkey cover the same workflow.