Approvals
Human-in-the-loop gates for high-risk agent actions.
When a policy rule has action require_approval, KorClaw creates an approval request. Reviewers approve or reject via PATCH /approvals/{id} (requires approvals:decide permission).
Approval replay
Approved approvals can be replayed by passing approval_id in policy evaluation or runtime execution. Replays expire 15 minutes after the decision. Context must match exactly.
Self-approval prevention
The API key that created an approval request cannot approve it (self_approval_forbidden, 403). Rejection requires a decision_note.