createApprovalGate
@forge/monorepo / backend/src / createApprovalGate
Function: createApprovalGate()
createApprovalGate(
deps):object
Defined in: backend/src/hitl/service.ts:303
The gate that makes approval unbypassable. A policy-classified tool (approvalPolicy other than
never, or an external/destructive effect under policy) may only execute directly when a
standing grant covers it, or when the call presents a one-time approval a human has decided and the
runtime has claimed.
Both paths fail closed. A tool with no grant and no ticket is refused; a ticket presented with no
interactions store to check it against is refused too, because an unwired dependency must never
be the reason something was allowed.
Parameters
deps
clock?
Clock
grants
interactions?
Where one-time approvals are verified. Optional so a caller that only uses standing grants need not wire it — with it absent, every ticket is refused rather than trusted.
Returns
object
isAllowed()
isAllowed(
context,tool,oneTime?):Promise<boolean>
Parameters
context
tool
approvalPolicy
"never" | "policy" | "always"
category
string
name
string
oneTime?
Returns
Promise<boolean>