local-first · v0.1
GIOS Studioalpha · read-only

Approval Authority

Phase IV · V2 — Given a validated execution request and CapabilityPlan, should execution be authorized? Capability answers WHAT is allowed; Approval answers MAY THIS proceed. Fail-closed; produces only decisions; issues single-use tokens the future Broker requires. Executes nothing. Read-only.

10
Requests
3
Authorized
7
Denied
3
Tokens issued
appr-dev-allowauthorized
development · 0 evidence · 0 lease
all_checks_passedtoken
appr-evidence-okauthorized
development · 1 evidence · 0 lease
all_checks_passedtoken
appr-evidence-missingdenied
development · 0 evidence · 0 lease
missing_evidence
appr-vault-okauthorized
development · 1 evidence · 1 lease
all_checks_passedtoken
appr-vault-expireddenied
development · 1 evidence · 0 lease
expired_lease
appr-vault-missingdenied
development · 1 evidence · 0 lease
vault_mismatch
appr-cap-denieddenied
development · 0 evidence · 0 lease
capability_denied
appr-emergencydenied
development · 0 evidence · 0 lease
emergency_stop
appr-cross-productdenied
development · 0 evidence · 0 lease
cross_product
appr-unknown-envdenied
qa · 0 evidence · 0 lease
unknown_environment
Environment profiles
development
max lease 3600s · 5 classifications
staging
max lease 1800s · 4 classifications
production
max lease 600s · 5 classifications

The Universal Approval Authority verifies capability grants, Vault lease validity, policy compatibility (emergency stop dominates), classification/risk, required approvals (evidence), expiration, environment compatibility, and cross-product/cross-agent isolation. Everything defaults to DENY: an unknown capability, expired lease, missing evidence, policy/vault mismatch, invalid scope, unknown environment, or unknown requester fails closed. It consumes CapabilityPlans (V1.5) and issues an ApprovalToken ONLY on authorize — single-use, scope-bound, expiring, and unexecuted. Approval never executes, never chooses providers, never owns secrets, and never performs Broker work; the future Broker (V3) requires the token before any Provider (V4) executes.