DocsPolicy & approvals

Policy & approvals

Rules evaluate before an action executes — allow, refuse, or hold for a named human — and the decision lands on the same chain as the action it governed, because a verdict in a side table is not evidence.

The decision call

the one synchronous call
verdict = await handle.decide({
    "action": "wire_transfer", "amount": 50_000, "sessionId": handle.session_id,
})
# → {"effect": "pending_approval", "policyId": "human-signoff-above-threshold", …}

Everything the decision is checked against — spend totals, burn rate, halt state, prior approvals — is derived server-side from the chain and overwrites anything the caller claims. An agent under a budget it wants to exceed is the normal case, not the adversarial one. Unreachable fails open, loudly: the response records that the check didn't run, so the trail shows an enforcement gap instead of a clean allow.

The six built-in rules

kill-switch          tenant halt; forbid-wins over everything; the flip itself is chained
human-signoff        money moves above your threshold wait for a named human
adverse-decision     decisions against people must carry a structured reason
tool-allowlist       deny-by-default tool scope per agent
burn-rate            on pace to blow the daily ceiling inside the hour ⇒ stopped now
cost-velocity        the daily ceiling and the runaway-loop cap

Every rule ships with monitor mode, and the arming sequence is deliberate: record → warn → enforce. A compliance product that starts blocking production traffic on install does not get a second call.

Approvals — dashboard and Slack

A held action appears on the dashboard queue, and — with a Slack incoming webhook configured — pings your channel with two answer paths: a dashboard link (named attribution, the approver's email on the chain) and HMAC-signed one-click links that expire in 24h and record the channel identity. Approve resumes the agent's next decide(); reject keeps it held, and the refusal is chained too.

control plane env
AUDITANT_SLACK_WEBHOOK_URL=   # an incoming webhook — no Slack app
AUDITANT_LINK_SECRET=         # signs the one-click links
AUDITANT_PUBLIC_URL=          # this control plane
AUDITANT_DASHBOARD_URL=       # for named approvals