Approvals

Manage approval workflows for agents and teams via the AgentOS Control Plane.

Approve, reject, and audit tool executions that require human authorization directly from AgentOS.

from agno.agent import Agent
from agno.approval import approval
from agno.db.postgres import PostgresDb
from agno.models.openai import OpenAIChat
from agno.os import AgentOS
from agno.tools import tool

db = PostgresDb(db_url="postgresql+psycopg://ai:ai@localhost:5532/ai")

@approval
@tool(requires_confirmation=True)
def delete_user_data(user_id: str) -> str:
    """Permanently delete all data for a user. Requires admin approval."""
    return f"All data for user {user_id} has been deleted."

agent = Agent(
    id="data-manager",
    model=OpenAIChat(id="gpt-4o-mini"),
    tools=[delete_user_data],
    instructions=["You help users manage data operations."],
    db=db,
)

app = AgentOS(
    agents=[agent],
    db=db,
).get_app()

Approval Flow

When a user triggers a tool decorated with @approval, the run pauses and a pending record is persisted to the database. An admin resolves the request via the AgentOS Control Plane or the API, and the run can then be continued.

Managing Approvals

View and resolve pending approvals from the AgentOS Control Plane. Each entry shows the agent, tool, arguments, and requesting user.

Review details, approve or reject, and track resolution history.

Approval Types

Type	Behavior	Use Case
@approval (default)	Blocking. Run pauses until an admin approves or rejects.	Deletions, payments, bulk operations
@approval(type="audit")	Non-blocking. The run pauses only for the tool’s HITL step. A resolved audit record is created after the step completes. Requires a HITL flag on @tool(), such as requires_confirmation.	Compliance logging, activity auditing

Approvals API

Operation	Endpoint
List approvals	GET /approvals
Get approval	GET /approvals/{approval_id}
Get approval status	GET /approvals/{approval_id}/status
Get approval count	GET /approvals/count
Resolve approval	POST /approvals/{approval_id}/resolve
Delete approval	DELETE /approvals/{approval_id}

When authorization is enabled, resolving requires the approvals:write scope. The same scope also lets you continue a run that is still paused on a required approval.

Next Steps

Task	Guide
Blocking approval basics	Approval basic
List and resolve workflow	Approval list and resolve
Audit-style approvals	Audit approval
Team-level approvals	Team approval
API reference	Approval API schemas