Approvals

Approve, reject, and audit tool executions that require human authorization directly from AgentOS.

Use a running PostgreSQL database with the ai user, password, and database on port 5532, or replace the example db_url. Install the server and driver dependencies and set the model key in its terminal:

uv pip install -U "agno[os]" openai "psycopg[binary]"
export OPENAI_API_KEY="your_openai_api_key"

Save this simulated deletion example as approvals_app.py, then start it with uvicorn approvals_app:app --host 127.0.0.1 --port 7777. The tool records a demonstration response and does not delete data.

from agno.agent import Agent
from agno.approval import approval
from agno.db.postgres import PostgresDb
from agno.models.openai import OpenAIChat
from agno.os import AgentOS
from agno.tools import tool

db = PostgresDb(db_url="postgresql+psycopg://ai:ai@localhost:5532/ai")

@approval
@tool(requires_confirmation=True)
def delete_user_data(user_id: str) -> str:
    """Simulate deleting user data after confirmation."""
    return f"Simulation complete for user {user_id}; no data was deleted."

agent = Agent(
    id="data-manager",
    model=OpenAIChat(id="gpt-4o-mini"),
    tools=[delete_user_data],
    instructions=["You help users manage data operations."],
    db=db,
)

app = AgentOS(
    agents=[agent],
    db=db,
).get_app()

Approval Flow

When a user triggers a tool decorated with @approval, the run pauses and a pending record is persisted to the database. An admin resolves the request via the AgentOS Control Plane or the API, and the run can then be continued.

Managing Approvals

View and resolve pending approvals from the AgentOS Control Plane. Each entry shows the agent, tool, arguments, and requesting user.

Review details, approve or reject, and track resolution history.

Approval Types

Approvals API

With RBAC enabled, resolving requires approvals:write. User-scoped non-admin callers cannot resolve or delete approvals: those routes return 404, even with the write scope. This applies to JWT users when user isolation is enabled and to scoped service accounts. Use an admin credential for those operations. Open instances and other unscoped callers retain access subject to their configured authentication and scopes.

Continuing a run is a separate check: approvals:write can authorize continuation of a run paused on a required approval, but does not bypass the resolve endpoint's user-isolation rule.

Next Steps