Human-in-the-loop approvals for agent tool calls

The decision happens in the response, not after the damage

Descles inspects the structured tool calls in the model response. A call that policy marks require_approval is replaced with a pending-approval placeholder and an approval is opened, so the runtime receives something it cannot execute. An operator sees the tool, the resource and the arguments the model proposed, then approves once or denies.

Approving opens a grant bound to that exact tool call — the same tool name and the same arguments — and consuming it is single-use. A re-issued call that does not match the approved parameters parks again instead of slipping through on a previous decision.

defaults:
  tools:
    Bash: require_approval        # name it exactly as your runtime declares it
    Write: deny
  arg_tools:
    - tool: terminal
      args:
        command: ["rm -rf*", "kubectl delete*"]
      decision: require_approval

Scoped by argument, not only by tool

The useful question is rarely "may this agent read files" but "may it read this file". Argument-scoped rules match the arguments inside a tool call, with deny beating approval beating allow, so a policy can allow a tool broadly and carve out the paths or commands that are never acceptable.

arg_tools:
  - tool: read_file
    args:
      path: ["**/.env", "**/secrets/**"]
    decision: deny

What an approver sees

Who requested it, which agent and group, the tool, the resource scope, and the arguments — on one decision surface, with the choice to deny or approve once. Denying is recorded as a decision, not a deleted row. Slack approvals are planned; today the decision surface is the console.

What happens if nobody approves in time?

The call stays held and the runtime is told it needs approval rather than being handed the tool call. The durable pending record and the resume path are what let the agent re-issue the same call later without parking again.

Can an approval be replayed to run a different command?

No. The grant is bound to the parameters of the approved call, so a changed argument is a new decision. Consumption is single-use.

Does approval replace a sandbox?

No, and it is not sold as one. Approval is a decision point for intent; a hard execution boundary belongs in the runtime or an action gateway.