Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.runaegis.co/llms.txt

Use this file to discover all available pages before exploring further.

When a policy evaluates an agent action and returns REQUIRE_APPROVAL, Aegis holds the action in a pending queue and waits for you to decide. The agent is paused, it cannot proceed until you approve or deny the request. This gives you a hard gate on sensitive operations without blocking routine work that passes policy checks automatically.

Which policies trigger approvals

Three built-in policies route actions to the approval queue rather than blocking them outright:
Any agent action that creates or merges a pull request is held for review. This ensures a human verifies PR content, branch, target, and description, before the change is merged.
Write actions targeting files or directories marked as sensitive (configuration files, secrets paths, core library code) are paused for human sign-off before execution.
Actions with a blast radius rated High or Critical are automatically routed to the approval queue. Aegis evaluates the potential impact of the action and requires human confirmation before the agent proceeds.

How the approval workflow works

1

Agent triggers a policy

Your agent calls a GitHub MCP tool. Aegis evaluates the action against your active policies. If a policy returns REQUIRE_APPROVAL, the action is paused immediately.
2

Request appears in the dashboard

The pending request is added to the approvals queue. The dashboard header displays a count badge for all unresolved requests. The dashboard home page also shows up to 5 pending approvals in the sidebar panel.
3

You review the request

Open the Approvals page from the dashboard sidebar. Each card shows you what to check before deciding.
4

Approve or deny

Click Approve to let the agent execute the action, or Deny to reject it. The agent receives the outcome immediately and either proceeds or receives an error response.

What each approval card shows you

Each pending request displays the following fields to help you make an informed decision:
FieldWhat it tells you
Tool nameThe GitHub MCP tool the agent wants to call (e.g. create_pull_request, push_files)
Action summaryA plain-language description of what the agent is trying to do
Action pointersBullet points breaking down the specific changes or arguments
Repository / branchThe target repo and branch for the operation
PR URLFor pull-request tools, the last action pointer typically contains a direct link to the GitHub PR so you can review the diff before deciding
TimestampWhen the agent submitted the request
To inspect the raw tool arguments, expand the Show details section on any card.

Approving and denying

When you act on a request:
  • Approve, Aegis executes the held action and returns the tool result to the waiting agent. The agent’s session continues.
  • Deny, Aegis sends an error back to the agent and discards the action. The agent can decide how to proceed.
After you act, the card moves from Pending to Approved or Rejected. You can review past decisions by switching the filter tabs on the Approvals page.

Where to find approval requests

Dashboard home

The pending approvals panel on the dashboard home page shows your most recent 5 unresolved requests with inline approve and deny buttons.

Approvals page

The full approvals queue at Dashboard > Approvals shows all requests across all statuses. Use the filter tabs to view pending, approved, or rejected requests separately.
Both the dashboard home page and the Approvals page auto-refresh every 30 seconds. You do not need to reload the page to see new requests arrive.

Pending state and expiry

A request stays in the pending state indefinitely until you act on it. There is no automatic timeout, the agent remains paused until you approve or deny the request, or until the agent’s session is terminated on the client side.
If you have multiple pending approvals, the Approvals page lets you filter by status so you can focus on unresolved items first.