coordination.approveModule 05Hold a risky write or delete until a signed-in person approves it, with the agent, resource and verb in front of them.
coordination.approve is the human approval queue. A write or delete that arrives without a confirmation token waits here as a pending request. A signed-in administrator or granted approver approves or denies it, and approving issues a single-use token for the agent to retry with.
Put admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuse
Plane module
idreasonapproval.statepending, approved, denied, or ./docs/coordination-approveAPI referenceRoutes, bodies and status codes./docs/coordination-approveOpen the consoleSee the module at work in the dashboard, on a seeded fleet or your own./dashboard-preview/approvalsStart freeCreate a workspace and admit your first intent./auth/signup
expiredusedapproval.gatehuman_write or human_delete: which gate the intent hit.approval.decidedBydecidedAt records when.approval.expiresAtapproval.hasTokentokenExpiresAtMs for its lifetime.ledgeredcoordination.admit refuses a write or delete that has no token and leaves a pending request, whose id comes back as approvalId.
GET /api/v1/acp/coordination/approvals lists the queue, with each item's agent, resource, verb and gate, human_write or human_delete.
approve takes an id and an optional reason. deny takes an id and a required reason. Both write a ledger event naming who decided.
An approval issues a single-use confirmation token. The asking agent, or an administrator, reads it from GET /api/v1/acp/coordination/approval.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private. coordination.approve docs
Press Run to send the request on the left to the shared demo workspace.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private.
A request in the shape the API accepts, and an example response in the shape the module returns.
POST /api/v1/acp/coordination/approve Authorization: Bearer av_workspace_•••• Content-Type: application/json { "id": "apr_1", "reason": "expected batch" } → 200 { approval, ledgered }
{
"approval": {
"id": "apr_7f3a",
"actorDid": "did:web:acme.example:agent:billing",
"resource": "repo:payments/main",
"action": "write",
"gate": "human_write",
"requestedAt": "2026-11-01T09:30:00.000Z",
"expiresAt": "2026-11-02T09:30:00.000Z",
"state": "approved",
"decidedBy": "user_ana",
"decidedAt": "2026-11-01T09:34:12.000Z",
"reason": "expected batch",
"tokenExpiresAtMs": 1793525952000,
"hasToken":
},
:
}A release agent tries to write repo:payments/main with no token. The request waits, and an on-call administrator approves it with the reason "expected batch".
An approver sees a delete on a customer table and denies it. The reason lands on the request and in the ledger for the agent's owner to read.
An administrator grants a teammate as an approver, so the queue is not one person's job. Revoking the grant takes the right back.
A request nobody decided expires. The agent gets a new request on its next attempt, and the old one cannot be approved late.
dual-control.scopes, where two administrators must agree.coordination.admit and your mandates.A module is a strong claim about a narrow thing. Rely on it for exactly what it is.
coordination.approval.approved or coordination.approval.denied event to the ledger.used is set when it is spent, and an unused token simply lapses.A request lapses after 24 hours and a token after 15 minutes. An administrator can change both within bounds: 60 seconds to 30 days for a request, 10 seconds to 24 hours for a token.
approval-settings, grant-approver and revoke-approver are administrator-only. The queue keeps the latest 200 decided items.
The agent that asked, or an administrator, can read a token. Anyone else sees only that one exists.
deny without a reason is refused. approve takes one but does not need it.Authenticate with a workspace API key as a Bearer token. The base URL is https://api.intramedial.com.
/api/v1/acp/coordination/approveApprove a pending request and issue its token./api/v1/acp/coordination/denyDeny a pending request with a reason./api/v1/acp/coordination/approvalsList the queue, settings and approvers./api/v1/acp/coordination/approvalRead one request, with its token for the asker.coordination.approvals.listList approval requests as an MCP action.coordination.approvals.approveApprove a request as an MCP action.coordination.approvals.denyDeny a request as an MCP action.coordination.admit01Intralock admissionDecide every action before it happens: an agent declares its intent, and Intralock admits it or names the reason it may not.dual-control.scopes22Two-person dual controlRequire two different administrators before the plane's most destructive actions run, and see whether the break-glass seal is intact.identity.enroll12Agent identity registryGive each agent its own identity before it acts, so every admitted action traces back to one agent and never to a shared account.coordination.lease02Resource leases and queuesHold a resource for one agent at a time, with a lease that lapses on its own and a queue for the agents that have to wait.civics.claims20Resource claims officeLet an agent state what it is about to work on before it takes a lease, and open a case when two claims collide.metering.snapshot21Metered usage by workspaceSee what the plane has counted for your workspace, meter by meter, and which billing meter each count feeds.