Human Approval and Agent Delegation
Pause exact high-risk tool intents for accountable human review, then let one agent invoke another without expanding the original user’s or team’s authority.
The enterprise problem and today’s slice
Enterprise problem: An agent can be correctly authenticated and tool-authorized yet still cause irreversible harm, while a nested agent can accidentally inherit the authority of its creator and turn composition into privilege escalation or an unbounded loop.
Whole-course context: The gateway now has machine and optional user bindings plus an argument-level decision; today consumes that exact canonical intent and actor chain before any high-risk execution or agent-to-agent call.
Today’s slice: Bind human approval to one immutable action, re-authorize immediately before use, and attenuate nested-agent authority across provider, runtime, generated-app, and source boundaries with depth, fan-out, budget, cycle, timeout, and cancellation limits.
End-of-day evidence: Reviewers receive observed approve, tamper-deny, bounded nested-call, and privilege-escalation-deny envelopes with immutable approval, run, delegation, trace, and source identifiers.
Still unsolved: Organization-specific risk tuning, emergency break-glass operations, and long-term evidence export or legal-hold policy remain deferred.
Thesis: Approval and delegation are safe only when they narrow one current actor chain to one exact intent; neither a human click nor a caller agent may create standing authority.
Smallest complete mental model: turn a proposed intent into a bounded grant, enforce that grant against current authority, and preserve evidence that can falsify the decision.
Boundary: This day covers provider-owned approval and agent-delegation state, hosted-runtime enforcement, and independent app/source vetoes. It does not choose Northstar's business risk appetite or replace the source provider's access-control list.
Customer outcome and implementation focus
The customer outcome is a reliable, reviewable implementation of 09 human approval and agent delegation. This day introduces the mechanism before policy detail and evidence review; it does not repeat the same customer stories in prose, tables, and diagrams.
Components in focus
Authorization policy service owns decisions; the connector/runtime gateway owns enforcement. Compute: API and isolated worker processes. Storage: PostgreSQL is authoritative for grants and state; Redis is a versioned cache; vault owns secrets; object storage retains redacted evidence only.
Implement the mechanism
Implement the day’s boundary with a current, explicit decision before privileged compute or a downstream call. Bind every effect to a tenant, subject or workload, deployment, resource, and short-lived evidence ID; a cache or model response never grants authority.
Failure modes, trade-offs, and decision rules
Approval systems often optimize for either speed or caution and then hide the cost, while delegation systems optimize for reuse and quietly widen authority. The consequence is predictable: reviewers approve vague prompts, specialist agents become confused deputies, or safe work becomes unusably slow.
| Pressure | Tempting shortcut | Resulting failure | Safer trade-off | Decision rule |
|---|---|---|---|---|
| Reduce review friction | Approve a tool or connector for a time window | One click becomes standing authority over unseen arguments | Approve a canonical intent once; batch only independently visible homogeneous items | Widen an approval only when every allowed item has the same risk, resource boundary, and revocation semantics |
| Survive retries | Mark approval reusable | Duplicate external side effects | Atomically claim once; reconcile uncertain provider outcomes with idempotency evidence | Never replay an uncertain write unless the downstream system proves the original outcome or accepts an idempotency key |
| Compose specialists quickly | Trust the callee deployment wholesale | Creator or internal-tool authority leaks to the caller | Expose a narrow operation contract and intersect current authorities | If the callee needs authority absent from the original actor chain, require a separate accountable grant rather than delegation |
| Increase agent autonomy | Raise depth, fan-out, and spend globally | Cycles and runaway descendants consume authority and budget | Set per-deployment limits and reserve budget before each edge | Bound the invocation graph at admission; monitoring after start is not a substitute |
| Preserve availability | Continue when approval or policy stores are stale | Revoked authority executes | Fail closed for high-risk writes; use bounded freshness only for classified low-risk reads | Choose freshness from impact: the harder the side effect is to reverse, the closer authorization must be to execution |
The key false dichotomy is “human approval or policy.” Approval supplements policy for accountable judgment; it never replaces current membership, deployment, tool, argument, connector, credential, and downstream checks. Likewise, agent reuse and least privilege are compatible when the invocation contract is explicit.
Implementation and verification
An elegant state model is not sufficient if no test races approval, replay, cancellation, and nested calls. Implement the smallest vertical slice through normal product surfaces, then prove both the intended action and the nearby action that must remain impossible.
- Canonicalize the Acme
slack.post_messageintent and persist its versioned digest before risk classification. - Implement the approval state machine with eligible approver, short expiry, atomic single-use claim, fresh authorization, and uncertain-outcome reconciliation.
- Expose
compliance.review_textas the only Campaign-to-Compliance edge; mint a callee-audience token that preservessub,act, team, deployments, parent run, limits, and trace. - Reserve depth, fan-out, tool-call, spend, and time budgets before committing each child edge; propagate cancellation to every descendant.
- Run an observed matrix: unchanged approval allow, changed argument deny, replay deny, revoked-member deny, allowed review, Legal-tool deny, cycle deny, depth deny, and cancelled-parent child stop.
- Assert every envelope contains actor, resource, scope, precondition, expected result, observed result, environment, timestamp, and immutable approval/run/delegation/decision/trace/source identifiers.
Falsifiable evidence: the design fails if altered arguments execute, an approval executes twice, a revoked actor passes the final check, the callee exposes an undeclared tool, authority grows at any edge, a cancelled child continues, or an evidence envelope cannot join the exact decision to the provider outcome.
Practical next action and falsifiable evidence
Reading about approval does not reveal whether Acme's real integration has a race or authority leak, so the next action is a narrow testable pilot. Pick slack.post_message for the HelixWorks Supplier Onboarding Agent, define its canonical material fields and one Compliance Agent operation, then capture one allow and every adjacent deny before adding another high-risk tool or callee.
The pilot is complete only when a reviewer can reproduce the unchanged one-time allow, argument-mismatch denial, replay denial, current-membership denial, bounded Compliance review, hidden Legal-tool denial, and cycle/cancellation denial from immutable IDs. Any unexpected allow is a release blocker; any missing join is an evidence defect, not a documentation gap.
This is falsifiable, observable evidence: the claim fails if any denied case executes, any allowed control stops working, or a reviewer cannot reproduce the result from the recorded intent, decision, trace, and delegation IDs.
Review checklist
- [ ] Approval binds one canonical tool intent, exact resource and arguments, short expiry, and single use.
- [ ] Every approved intent is fully re-authorized against current state immediately before execution.
- [ ] Callee authority is the intersection of user, team, caller grant, callee deployment, and callee manifest; creator authority is absent.
- [ ] Audience-bound delegated tokens are re-authorized by the callee and cannot invoke hidden internal tools.
- [ ] Depth, fan-out, cycle, budget, timeout, and cancellation controls produce observed negative evidence and preserve unaffected positive controls.
HelixWorks repository lab
HelixWorks separates approval requirements from execution authority. The blueprint contract in packages/contracts/src/http.ts declares reviewers; an exact argument digest later binds execution:
workflow: z.object({
name: z.string().min(3).max(120),
purpose: z.string().min(10).max(1000),
requiredApprovals: z.array(
z.enum(['procurement', 'security', 'legal']),
).min(1),
connectorCapabilities: z.array(z.string().min(3).max(120)).max(20),
}),
The intent is reviewable supplier-onboarding policy, not standing permission. Zod validates it; the control plane freezes it into a digest; CPU and storage hold the immutable record; a changed digest proves a changed requirement did not hide under an old release. Contract validation, approval workflow, and execution are SRP boundaries. Shared contracts are DRY, ports provide IoC/DI, and PubSub distributes the approved fact.
pnpm --filter @helixworks/contracts test
pnpm --filter @helixworks/control-plane test
Change Northstar's required approvals from procurement and security to procurement only. The digest must change and the old approval must not authorize the new intent. The repository is a building block: implement a one-time approval claim before calling this production-complete. Reusing an old approval falsifies the model.