> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentsfleet.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Approve a waiting run

> Review requested access, approve or deny it, and revoke standing grants.

## What this does

Review what a fleet wants to do before granting access. A run that needs
approval waits until someone approves or denies its request.

Use `agentsfleet approvals` to inspect requests and decide them from your terminal.

## Before you begin

Two kinds of request can appear:

| Kind | Raised by | Scope of a decision |
| - | - | - |
| `integration_grant` | Saving a fleet that needs credentials from a connected service | Covers that fleet and service until revoked. |
| A kind you name | A rule under `gates` in the fleet's Definition | Covers the actions described by the rule's `blast_radius`. |

Saving a fleet that needs service credentials creates its grant request.
The fleet reads `installing` until someone approves it. Then run
`agentsfleet resume <FLEET_ID>` to finish setup, and the fleet reads `active`.

A repository write uses that standing grant. You do not approve every run separately.

Sign in and select the workspace that owns the fleet. A tenant API key needs `approval:read` to list gates and `approval:resolve` to decide them.

## Steps

1. List the gates waiting in the active workspace.

   ```bash theme={"theme":"vesper"}
   agentsfleet approvals list
   ```

   ```text theme={"theme":"vesper"}
   GATE      FLEET     KIND      STATUS    ACTION
   <varies>  <varies>  <varies>  <varies>  <varies>
   ```

   Add `--fleet <FLEET_ID>` to narrow the list to one fleet.

2. Read what the gate grants.

   `<GATE_ID>` comes from the `GATE` column.

   ```bash theme={"theme":"vesper"}
   agentsfleet approvals show <GATE_ID>
   ```

   ```text theme={"theme":"vesper"}
   <varies>
   ```

   Check the fleet, request kind, and status. The `blast_radius` describes
   exactly which actions your approval permits.

3. Decide the gate.

   ```bash theme={"theme":"vesper"}
   agentsfleet approvals approve <GATE_ID>
   ```

   ```text theme={"theme":"vesper"}
   <varies>
   ```

   Deny the request if it asks for more access than the task needs.

   ```bash theme={"theme":"vesper"}
   agentsfleet approvals deny <GATE_ID>
   ```

   ```text theme={"theme":"vesper"}
   <varies>
   ```

## Verify it works

```bash theme={"theme":"vesper"}
agentsfleet status
```

```text theme={"theme":"vesper"}
Fleets
Name: <varies>
Status: active
Events: <varies>
Budget: <varies>
Waiting: 0
```

`Waiting` counts requests that need your decision. Approving a waiting run lets
it continue, and `agentsfleet steer` returns its reply.

## Common problems

`UZ-APPROVAL-002` means the gate is no longer open. It timed out, or someone decided it in the dashboard. List the gates again.

`UZ-APPROVAL-006` means someone decided this gate first. Run `agentsfleet approvals show <GATE_ID>` to read the outcome and who recorded it.

`UZ-GRANT-001` means the fleet has no approved grant for the service.
No credential is issued, and the run makes no provider call. Check with
`agentsfleet grant list --fleet <FLEET_ID>`.

`UZ-REPAIR-010` and `UZ-REPAIR-011` are retired and no longer returned. Both described a per-event repository-write gate that is no longer raised. A run that cannot write now fails with `UZ-GRANT-001` instead.

## Remove or undo

A request can be decided once. Denying it ends the waiting run without granting
access. An approved integration grant can later be revoked.

To revoke a grant, copy `<GRANT_ID>` from `agentsfleet grant list --fleet <FLEET_ID>`.
Then run `agentsfleet grant delete <GRANT_ID> --fleet <FLEET_ID>`.

To change which repositories a fleet may reach, or to drop it to read-only,
change `repositories` or `repository_access` in a private improvement chat.
Open the fleet's **Setup → Edit fleet**, ask for the change, check the
updated setup, and choose **Save changes**.

The next service credential uses the updated repository access. The grant stays
approved, and the fleet keeps running.

Deleting the grant removes all access to that service for this fleet,
including every repository it reached through the service.
The next event is refused before the fleet contacts the provider.

## Related pages

* [Run and control a fleet](/fleets/running)
* [Author a fleet](/fleets/authoring)
* [API scopes](/api-reference/scopes)
* [Command reference](/cli/agentsfleet)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.