approvals

readonly approvals: HarnessApprovalLedger

Persistent, authorization-gated approval inspection and decisions.

inspect()

inspect(id): Promise<HarnessApproval>

Parameters

Parameter	Type
`id`	`string`

Returns Promise<HarnessApproval>

grant()

grant(id): Promise<HarnessApproval>

Parameters

Parameter	Type
`id`	`string`

Returns Promise<HarnessApproval>

deny()

deny(id): Promise<HarnessApproval>

Parameters

Parameter	Type
`id`	`string`

Returns Promise<HarnessApproval>

Required Actions

Each decision is checked against the authorization port, which must allow one action. Without the port, every decision fails closed.

Operation	Action
`inspect()`	`agent_harness.approvals.read`
`grant()`	`agent_harness.approvals.grant`
`deny()`	`agent_harness.approvals.deny`
The approved call	The tool’s action from `toolActions`

HarnessApproval

Properties arguments

readonly arguments: JSONValue

authorization

readonly authorization: AgentHarnessAuthorizationIdentity

createdAt

readonly createdAt: number

expiresAt

readonly expiresAt: number

readonly id: string

requiredAction

readonly requiredAction: string

runId

readonly runId: string

status

readonly status: "pending" | "granted" | "denied" | "expired" | "consumed"

toolCallId

readonly toolCallId: string

toolName

readonly toolName: string

updatedAt

readonly updatedAt: number

HarnessApprovalStatus

HarnessApprovalStatus = typeof HARNESS_APPROVAL_STATUSES[number]

Status	Meaning
`pending`	Requested and undecided.
`granted`	Approved, and usable until `expiresAt`.
`denied`	Refused.
`expired`	Not decided, or not used, within its lifetime. The run then fails with `failureCode` `HARNESS_APPROVAL_EXPIRED`.
`consumed`	Used by the call it approved.

HARNESS_APPROVAL_STATUSES

const HARNESS_APPROVAL_STATUSES: readonly ["pending", "granted", "denied", "expired", "consumed"]

HarnessAuthorizationError

Constructors Constructor

new HarnessAuthorizationError(code): HarnessAuthorizationError

Parameters

Parameter	Type
`code`	`"identity_unavailable"` \| `"unauthenticated"` \| `"forbidden"` \| `"policy_unavailable"`

Returns HarnessAuthorizationError Properties cause?

optional cause?: unknown

code

readonly code: "identity_unavailable" | "unauthenticated" | "forbidden" | "policy_unavailable"

message

message: string

name

name: string

stack?

optional stack?: string

stackTraceLimit

static stackTraceLimit: number

The Error.stackTraceLimit property specifies the number of stack frames collected by a stack trace (whether generated by new Error().stack or Error.captureStackTrace(obj)). The default value is 10 but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed. If set to a non-number value, or set to a negative number, stack traces will not capture any frames. Methods captureStackTrace()

static captureStackTrace(targetObject, constructorOpt?): void

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}. The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace. The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters

Parameter	Type
`targetObject`	`object`
`constructorOpt?`	`Function`

Returns void prepareStackTrace()

static prepareStackTrace(err, stackTraces): any

Parameters

Parameter	Type
`err`	`Error`
`stackTraces`	`CallSite`[]

Returns any See https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Code	Meaning
`identity_unavailable`	There is no authorization port, or it gives no identity.
`unauthenticated`	The identity names no Service Account or organization.
`forbidden`	The policy denies the action.
`policy_unavailable`	The policy gives no decision.

HarnessApprovalError

Constructors Constructor

new HarnessApprovalError(code): HarnessApprovalError

Parameters

Parameter	Type
`code`	`"expired"` \| `"replayed"` \| `"conflicting"` \| `"consumed"` \| `"missing"`

Returns HarnessApprovalError Properties cause?

optional cause?: unknown

code

readonly code: "expired" | "replayed" | "conflicting" | "consumed" | "missing"

message

message: string

name

name: string

stack?

optional stack?: string

stackTraceLimit

static stackTraceLimit: number

static captureStackTrace(targetObject, constructorOpt?): void

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters

Parameter	Type
`targetObject`	`object`
`constructorOpt?`	`Function`

Returns void prepareStackTrace()

static prepareStackTrace(err, stackTraces): any

Parameters

Parameter	Type
`err`	`Error`
`stackTraces`	`CallSite`[]

Returns any See https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Code	Meaning
`expired`	Its lifetime has passed.
`replayed`	The same decision is already recorded.
`conflicting`	The opposite decision is already recorded.
`consumed`	The approved call has already executed.
`missing`	The approval record the decision needs does not exist.

Get Started

Inside the Managed Harness

The Agent Harness SDK

The Agent Runtime SDK

The Agent Client SDK

For AI Agents

inspect()

grant()

deny()

Required Actions

HarnessApproval

HarnessApprovalStatus

HARNESS_APPROVAL_STATUSES

HarnessAuthorizationError

HarnessApprovalError

​inspect()

​grant()

​deny()

​Required Actions

​HarnessApproval

​HarnessApprovalStatus

​HARNESS_APPROVAL_STATUSES

​HarnessAuthorizationError

​HarnessApprovalError

inspect()

grant()

deny()

Required Actions

HarnessApproval

HarnessApprovalStatus

HARNESS_APPROVAL_STATUSES

HarnessAuthorizationError

HarnessApprovalError