Explicit approval
Author the wait in Program source:await_approval. The Program decides what
approval and denial mean next; a denial does not automatically select a hidden
failure path.
Put the wait before the consequential effect. Write a prompt that identifies
the action, target, and evidence a reviewer needs.
Named signals
Use a signal when an authenticated integration knows the Workflow and run IDs and should resume the Program by name:Idempotency-Key when retrying the same delivery;
use a new key only for a distinct event.
Approval wait versus policy gate
An authored approval wait and a capability-policy gate are different objects:
Bound capability calls on the Workflow surface normally use the Workflow’s
authored-plan policy lane. Account deny rules and the hard safety floor still
apply. Use
await_approval when the process itself requires human judgment.
Design limits
- Approval and signal waits have no deadline parameter on the current Program surface.
- A transient Agent-authored procedure cannot use either durable wait.
- A signal is authenticated through the Management API. Use a callback when a third party should resume one exact wait with a bearer URL instead.
- Cancel abandoned waits so they do not remain active indefinitely.