blueclawApproval
An approval is a person's answer to a tool call the host held before it ran.
The gate belongs to the host. approvalgate.Gate.TurnGate is installed as the ToolCallGate on every harness's tool set, so every harness meets the same gate on the same calls. A call is held when its descriptor sets RequiresApproval, or when the tool's input schema declares an approvalRequired field and the call sets it. An external_send into the conversation it was asked in (targetType currentThread or currentChannel) proceeds without asking. A delegated turn cannot ask and is denied.
A held call pauses the run in waiting_approval and records approval.pending_call with the exact call, so the approval survives a restart and blocks no live request. The question the person sees is written by the model. Once approved, the host carries out the recorded call verbatim in the carryOutApprovedCall launch step (internal/agentruntime/approved_call.go) and hands the result to the harness as CarriedOutCalls. A changed call is a new approval.
A grant can cover the rest of the task when the tool declares an ApprovalScope.