# Approval flow (Slack) Irreversible or externally-effecting actions wait for a human's approval before running. Approval is given through Slack. ## Flow 1. The gate ESCALATEs a call and generates a unique approval id. 2. A message with approve/deny links is posted to the Slack webhook. 3. The gate waits. An authorised person clicks one of the links. 4. Approved → the call proceeds. Denied or timed out → BLOCK. > **Arguments are not redacted**: The Slack message contains the call's arguments (`args`) as they are. The redaction applied to the audit log does not apply here. Only add people who may approve to the channel. The default wait is 2 minutes (`APPROVAL_TIMEOUT_MS`); when it runs out the call is blocked. ## Safety properties - **Single use:** A second click on the same id returns 404; no double approval. - **CSRF token:** Each pending approval carries its own token. - **Fail-closed:** A timeout is always a block. - **Missing configuration:** If `SLACK_WEBHOOK_URL` is set but `APPROVAL_BASE_URL` is not, all escalations are blocked. ## Configuration | Variable | Default | Description | | --- | --- | --- | | `SLACK_WEBHOOK_URL` | — | Slack incoming-webhook URL. | | `APPROVAL_BASE_URL` | — | Externally reachable base of the approval links. | | `APPROVAL_PORT` | `3001` | Approval HTTP server port. | | `APPROVAL_TIMEOUT_MS` | `120000` | Wait time (ms). |