Review approval requests
Approval requests protect operations that move, permanently delete, or send mail. Each request is
bound to one mailbox and has an ID beginning with chk_.
What the requester receives
Section titled “What the requester receives”An intent call returns a pending request and a review URL. Nothing has changed in the mailbox yet. The requester can share the URL, wait for the decision, inspect status, or withdraw its own request.
The agent-supplied reason is supporting context, not trusted instructions. Alcarta renders the actual action separately from that reason.
Review a request
Section titled “Review a request”Open Approvals, choose a request, and verify:
- the requesting identity and mailbox;
- the action Alcarta will perform;
- the current message, destination folder, or complete draft content;
- recipients and attachments for a send;
- any warning that the provider state changed since the request was filed.
Approving dispatches the work. The requesting agent does not need to return and make a second call for the operation to begin. Denial records the decision and performs no provider mutation.
Request states
Section titled “Request states”| State | Meaning |
|---|---|
pending |
Waiting for a decision |
pending_commit |
Already authorized, waiting through a cancellation window |
approved |
Approved and dispatched; execution is in flight |
executing |
A worker holds the execution lease |
executed |
Provider action completed |
denied |
An approver rejected it |
cancelled |
The requester or an authorized subject withdrew it |
expired |
Nobody decided before its deadline |
failed |
Execution reached a terminal error |
Terminal states never reopen. A failed operation requires a new request.
Four-eyes enforcement
Section titled “Four-eyes enforcement”The requester cannot decide its own request by default. A machine approver needs the
approval_commit scope, and both the organization and mailbox must allow bot commits. Alcarta
records requester and decider separately.
The web UI has a narrow single-admin escape hatch for requests created by that human through the web interface. It does not turn agent self-approval on.
Provider changes and races
Section titled “Provider changes and races”Alcarta re-reads the provider state before executing. If a message vanished, moved ambiguously, or a draft changed after review, the request fails visibly instead of acting on a guess. Cancelling an approved request can race with execution; cancellation succeeds only if it wins before the worker.