harn-approval-review

Approval review

A permission gate that refuses work on a non-interactive run used to end the run. There was nobody to ask. The approval resolver decides who answers instead, and the reviewer is a model that answers by reading the refused action against the user's actual goal.

Pair with [[harn-agent]] for the loop this runs inside and [[harn-testing]] for what counts as evidence.

The reviewer is not a security boundary

It is a judgment layer above a boundary that stays exactly where it was. The sandbox is not relieved of its job because a reviewer exists, and no claim about this feature should imply otherwise. Cursor says the same of its own auto-review and is right to.

Two orthogonal axes

PolicyAction {allow, ask, deny} is the per-rule verdict. ApprovalResolver {host, auto_review, allow_all} is who answers when a rule says ask. They are separate types on purpose: PolicyAction is ranked and that rank drives most-restrictive-wins composition across the policy stack, so "is allow_all more restrictive than allow?" is a question with no answer and must never be asked.

• host — ask a person. A surface that cannot reach one reports the ask as unsatisfiable rather than answering on their behalf.
• auto_review — route to the reviewer. Headless and eval default.
• allow_all — answer every ask yes. This is what yolo and full-auto mean, and it has one owner rather than a per-surface empty policy overlay.

allow_all does not lift the catastrophic floor. That is the one thing yolo still refuses.

Install a reviewer on a loop

import { approval_reviewer_for } from "std/agent/approval_review"

agent_loop(harness, task, system, {
  approval_policy: policy,
  approval_reviewer: approval_reviewer_for(harness, review_policy, goal),
})

goal is required, not optional. The reviewer's question is never "is this command dangerous" in the abstract — it is "does THIS goal authorize THIS action". A reviewer given no goal can only reason from the command, which is the weaker instrument and the one that produces both kinds of error.