Skip to main content

​
What this does

Review what a fleet wants to do before granting access. A run that needs approval waits until someone approves or denies its request. Use agentsfleet approvals to inspect requests and decide them from your terminal.

​
Before you begin

Two kinds of request can appear: Saving a fleet that needs service credentials creates its grant request. The fleet reads installing until someone approves it. Then run agentsfleet resume <FLEET_ID> to finish setup, and the fleet reads active. A repository write uses that standing grant. You do not approve every run separately. Sign in and select the workspace that owns the fleet. A tenant API key needs approval:read to list gates and approval:resolve to decide them.

​
Steps

  1. List the gates waiting in the active workspace.
    Add --fleet <FLEET_ID> to narrow the list to one fleet.
  2. Read what the gate grants. <GATE_ID> comes from the GATE column.
    Check the fleet, request kind, and status. The blast_radius describes exactly which actions your approval permits.
  3. Decide the gate.
    Deny the request if it asks for more access than the task needs.

​
Verify it works

Waiting counts requests that need your decision. Approving a waiting run lets it continue, and agentsfleet steer returns its reply.

​
Common problems

UZ-APPROVAL-002 means the gate is no longer open. It timed out, or someone decided it in the dashboard. List the gates again. UZ-APPROVAL-006 means someone decided this gate first. Run agentsfleet approvals show <GATE_ID> to read the outcome and who recorded it. UZ-GRANT-001 means the fleet has no approved grant for the service. No credential is issued, and the run makes no provider call. Check with agentsfleet grant list --fleet <FLEET_ID>. UZ-REPAIR-010 and UZ-REPAIR-011 are retired and no longer returned. Both described a per-event repository-write gate that is no longer raised. A run that cannot write now fails with UZ-GRANT-001 instead.

​
Remove or undo

A request can be decided once. Denying it ends the waiting run without granting access. An approved integration grant can later be revoked. To revoke a grant, copy <GRANT_ID> from agentsfleet grant list --fleet <FLEET_ID>. Then run agentsfleet grant delete <GRANT_ID> --fleet <FLEET_ID>. To change which repositories a fleet may reach, or to drop it to read-only, change repositories or repository_access in a private improvement chat. Open the fleet’s Setup → Edit fleet, ask for the change, check the updated setup, and choose Save changes. The next service credential uses the updated repository access. The grant stays approved, and the fleet keeps running. Deleting the grant removes all access to that service for this fleet, including every repository it reached through the service. The next event is refused before the fleet contacts the provider.