ALLOW, DENY, and APPROVAL_REQUIRED — the three outcomes of every consequential action
Lead
High-risk automation needs three control routes, not binary pass/fail. Each route must leave replayable evidence.
Opening
Binary allow/deny is insufficient for enterprise automation. Many actions are legitimate but require human judgment — large refunds, production config changes, first-seen delegations.
APPROVAL_REQUIRED is a first-class route: policy escalates, a named approver authorizes this exact action, and evidence binds the approval to execution.
Why evidence matters for all three
ALLOW without evidence is unprovable. DENY without evidence is disputed. APPROVAL_REQUIRED without a bound approval token is repudiable.
Humbleaf preserves hash-bound evidence bundles for every route.
Related
