Put AI Agent Actions Behind an Approval Gate From API to Worker

Short summary

An architectural pattern for binding AI agent actions to an approval gate from API to worker, ensuring reviewers authorize an exact plan via version and digest rather than a simple Boolean. The worker reloads grants before every external action and rejects mismatches, expirations, or revocations. Includes TypeScript types, API routes, a failure-mode table, and guidance on cross-layer testing with real databases.

• •Approval binds exact plan version and digest to short-lived grant, not a Boolean flag
• •Worker rechecks grant before every external action; rejects stale, revoked, or mismatched plans
• •Failure-mode table covers plan changes, duplicate approvals, revocation races, and worker death

Generated with AI, which can make mistakes.