writ approve
An enforcing connection or MCP proxy creates an approval request when a tool call needs assent. Writ does not execute the stored call. The agent must retry after approval.
An organization policy can also require approval for selected tools.
List pending requests
Section titled “List pending requests”writ approvalsThe command shows the writ, tool name, argument digest, and arguments for each pending request.
Approve one matching retry
Section titled “Approve one matching retry”writ approve <request-id>The default scope is once. It permits one retry with the same tool name and
argument digest. Any changed argument needs another approval.
The command shows the request and asks for confirmation in an interactive terminal. Add a reason when it helps a reviewer:
writ approve <request-id> --reason "This release needs the generated file."Approve matching calls for the run
Section titled “Approve matching calls for the run”writ approve <request-id> --scope runThis scope permits matching calls in the same run or connected agent session. It expires when that run ends.
Deny a request
Section titled “Deny a request”writ deny <request-id> --reason "This path is outside the task."A denial applies to that exact call for the rest of the run. It does not edit the project or organization policy.
Read the history
Section titled “Read the history”writ review <name> --where text~approvalThe record contains the request, human decision, use, or expiry.
The approval command identifies the operator by the current operating-system account. Use process or account isolation when another process under that account must not reach the approval store.