Skip to main content
Approvals, at the top of the sidebar, holds tool calls that a workload’s policy stopped for a person to decide. In the page’s own words: “When a run’s policy holds a tool call for a person to decide, it shows up here.” The inbox shows the requests waiting for you; a number on the sidebar row counts them.

​
Who may decide

Each workload names its approvers under Workloads › (workload) › Approvers. The Approvals queue lists only requests you can approve: if you are not an approver for any workload, it stays empty. Any member, Read included, can still see a run’s requests on that run’s page under Workloads: its Approvals tab lists each one with its status, who decided it and when. A pending request shows a Decide link only to someone who can approve it. A run’s requests can also be opened on the Approvals page filtered to that run (/approvals?run_id=<run id>, headed “Showing requests from one run only.”); there a request you cannot decide shows no Approve or Deny, only “Viewers can see requests but cannot decide them.” for a Read member or “You are not an approver for this workload.” for anyone else. If a decision is refused because you are not an approver, the page also says “You are not an approver for this workload.” A partner’s delegated session can neither see nor decide requests. Approving needs a recent sign-in. If yours is older than ten minutes the page says “Approvals need a sign-in from the last 10 minutes. Nothing was sent.” and offers Sign in again.

​
Decide

1

Read the request

Each card is one held tool call. The title is the rule that held it; the subtitle names the workload and how long it has waited. The card lists the Tool, the Folder and the App. Text written by the agent carries the badge “Written by the agent”, so you know which words are the agent’s.
2

Reveal hidden values

Secrets in the request are masked. Press Reveal hidden values to see the request with the values filled in. You cannot approve what you have not seen: the page refuses with “Reveal the hidden values before you approve.” If the values were not stored, the request can only be denied.
3

Approve or deny

Approve lets the call run: “Approved. The agent’s call will run.”Deny stops it. The dialog asks “Deny this tool call?” and offers an optional Guidance for the agent: a sentence telling the agent what to do instead. Deny and send guidance passes it on. The agent sees “Denied by” followed by your name “via Quint”, with your guidance.

​
From Slack or Teams

If a channel is connected, each request is also posted there with a link. The link opens the Approvals page on that one request (“Showing the request from your notification.”). If the request is no longer yours to decide, the page says “This request is not in your queue: it was decided, it expired, or you are not one of its approvers.” See Alerts and approvals in Slack, Teams and PagerDuty.

​
When nobody answers

A request waits for the workload’s Approval wait (default 10 minutes), then expires and is denied. The agent sees “Approval timed out after N s”. A workload with no approvers set behaves the same way; the workload page warns: “Nobody is set as an approver, so a held tool call from this workload waits until it expires and is then denied.” A workload with no working notification channel does not hold at all; its requests are denied with a notice that an admin can choose a channel in the dashboard.

​
Where decisions are recorded

On the run’s page under Workloads, the Approvals tab lists each request with Rule, Status, Held, Decided by, Decided and Guidance. The Activity tab counts blocked and held calls among the events loaded. See Read a run.

​
Approvals on laptops

This inbox is for workloads: agents running in containers. On an enrolled Mac, when your organisation has armed a rule that asks, the decision is offered to the person at that machine as a macOS notification (“Your agent wants to run a command”, with Allow, Review and Deny). It does not appear in this inbox. See Quint is on my machine.

​
If this fails