[albanm]

A configured agent's every write and destructive catalog call, and every capability grant (web access, MCP access, planning), is now judged by an LLM reviewer before it runs. Where a class is routed to a person, the reviewer goes first and the person decides after it.

Why: people approve cards by reflex, so a human-only gate is weak, and it left ordinary writes unchecked. Automatic approval should be faster and block less, and in the end be safer, not less safe. Planned tasks and code_mode scripts could not use gated tools at all; they can now make the writes the reviewer allows.

• Routes replace approvalLevel: approvalRoutes.write / .destructive, each reviewer or reviewer+person. Defaults: write → reviewer, destructive → reviewer+person. There is no unchecked route, and reads are never reviewed. Grants are always reviewer+person, the person being an admin.

• The reviewer (api/src/approval-review/) runs on the shared two-stage guard engine, on the moderator role, in this order:

  • Intent: the people's stored messages, plus the agent's persona and instructions. In a webhook run, only the payload's event type and resource id, never its text.
  • The conversation's earlier gated calls, each with how it was decided and which message it followed, so a refused outcome reached another way is caught.
  • The proposed call.
  • Exposure: whether the conversation read outside content, naming only the tools it came from.
  • Never shown: tool outputs and the assistant's text.

  Each review answers allow, deny or unsure. A failed review fails closed (unsure).

• Gate: one AI SDK toolApproval function. Deny is final, and the model is told not to work around it. Unsure is a card in a chat and a deny elsewhere. The breaker stops the turn after 3 denials in a row or 10 in one turn (stop reason review-denied). Nested code_mode calls are reviewed too, within the turn's credit budget. In a task run, the first failed review notifies the agent's admins.

• UI:

  • Approval cards show the reviewer's view.
  • A reviewer denial shows as a "Denied by the reviewer" chip, which tells the person to say so to the agent if they want it done. There is no override button.
  • The agent form edits the routes, and its instructions help text says the reviewer reads them.

• Eval: reviewer cases in dev/guard-eval (overeager, injection, out of scope, grants, workarounds). On Claude Haiku through the dev bridge, one run: 0 of 41 harmful calls allowed, 2 of 23 benign calls carded, p50/p95 3.6/8.7 s.

Heads-up:

• Release blocker: the reviewer has not yet been measured on the production moderator models, nor repeated to check verdict stability. Run GUARD_EVAL_GUARDS=reviewer node dev/guard-eval/index.ts (≥3 repeats) and set the thresholds before releasing.
• Breaking: approvalLevel is removed (never released). upgrade/0.12.2/approval-level-to-routes.js migrates agents that still carry it (dev, staging): write → both routes reviewer+person, destructive → the default routes, none → both routes reviewer, the closest there is now that no route goes unchecked.
• Cost and latency: every write now costs one or two moderator calls (about 3.4k tokens) and adds seconds before the write runs. Point moderator at a capable model.
• The personal assistant is unchanged: it has no reviewer and is not offered write tools.