Let your agents take real actions. A person still signs off.
Add one tool call. The agent pauses, the right person decides in Slack, email or the web, and the agent picks up where it left off, even days later. Every decision is signed, and the record shows which actions can safely run on their own.
import { PromptCompute } from "@promptcompute/sdk" // The agent can call refund() whenever it wants. // Policy decides whether a person has to say yes first. const refund = new PromptCompute().withApproval(issueRefund, { action: "refund.create", reason: (a) => a.reason, }) await refund({ orderId: "ord_123", amount: 240 })
The agents worth building change things. That is where security says no.
An agent that drafts is easy to approve. An agent that refunds, emails customers or edits records needs someone accountable for each step. Approvals gives your security team a yes with conditions.
Easy yes
Low risk, low value. Most agents are stuck here.
Usually yes
Saves minutes. A person still does the work.
Yes, with Approvals
Refunds, sends, deploys and record changes, with a named approver and a signed record.
Ask, decide, resume.
Your agent keeps doing the work. Approvals handles who gets asked, how long to wait and what to record.
The agent asks
Call request_approval before a risky action. Rules decide if it runs now, waits for a person or is refused.
A person decides
The right group gets a card. They approve, change the amount, reject with a note or ask the agent a question. Escalation and delegation are built in.
The agent resumes
It gets the final arguments, including any edits. Waits survive restarts and deploys, whether they last a minute or three days.
Start supervised. Let the record decide what runs alone.
Approvals tracks how people decide on each kind of action. When a bucket has a long, clean record, it suggests letting that bucket run on its own, and backs off by itself if that turns out wrong.
- Suggests only with evidence. At least 200 decisions, a 97% lower bound on unchanged approvals, no recent rejections.
- Tests in shadow first. People keep deciding for two weeks while Approvals checks it would have agreed.
- Keeps checking. 5% of auto-approved actions still go to a person. Rejections there revert the rule within a minute.
- Your rules, your call. Mark any action as never automatic.
Who approved it, what they saw, and what actually ran.
Every request, decision and rule change is written to a hash-chained ledger and signed. A daily root goes to a public log, so you can check nothing was changed later, with our open-source tool, not our word.
- Card snapshots. The record proves what the approver was shown.
- Execution check. If the agent runs something other than what was approved, you get an alert.
- Evidence packs. Export a period's policies, approvers and decisions for auditors, with a mapping to EU AI Act Article 14 oversight measures.
refund.create amount=240.00 rule=refund-over-200
prev 9f2c…e1 hash 3ab0…7d sig ok
by marcus@acme.example amount 240.00 → 150.00
card snapshot 77c1…a9
prev 3ab0…7d hash c41e…02 sig ok
args hash matches approved ✓ match
prev c41e…02 hash 0d9b…5f sig ok
4,184 entries, chain intact, anchored 2026-10-17
Write the rules once. Review them like code.
Policies live in your repo as YAML. Test a change against the last 30 days of real requests before you publish it, and see exactly which past decisions would have changed.
rules: - id: refund-small match: { action: refund.create, when: "args.amount <= 50" } effect: auto_approve - id: refund-over-200 match: { action: refund.create, when: "args.amount > 200" } effect: require_approval approvers: [group:support-leads] escalate: [{ after: 4h, to: group:ops }] risk: high # passkey required to approve default: effect: require_approval
How ready is your product for enterprise AI buyers?
Paste a URL. In about a minute we check 22 things a buyer's security team will ask about, from SSO to AI data terms to agent controls. Every finding links to the page it came from.
Acme maintains a SOC 2 Type II report covering…from acme.example/trust
Agent action controls: not found in public pages. 14 pages checked.
Start free. Pay as your agents do more.
A request is one call to request_approval, including ones the rules approve automatically, since those get a signed record too.
Team
For an agent in production.
- 5,000 requests, then $0.02 each
- Email, escalation, delegation
- Earned autonomy suggestions
- 1-year record
Business
For many agents and an audit.
- 25,000 requests, then $0.015 each
- Single sign-on (OIDC) and SCIM, passkey step-up
- Evidence packs and exports
- 7-year record
Enterprise
For regulated data.
- Sealed fields with your keys
- EU data region
- Microsoft Teams
- SLA and named contact
What teams ask before they start.
Does promptcompute run the action?
No. Your agent does, with the final arguments the approver accepted. We never hold the credentials for your systems.
What if nobody answers?
Each rule sets reminders, an escalation path and what happens at expiry. The default at expiry is reject.
Can the agent talk its way past a rule?
No. Its stated reason shows in a box marked unverified, and its risk estimate can raise the risk level but never lower it. The card summary comes from your template, not from the agent.
Will it work with our framework?
If your agent can call an MCP tool or make an HTTP request, yes. We ship adapters for Claude Agent SDK, Claude Code, OpenAI Agents SDK, LangGraph, Temporal and Inngest.
Does this make us EU AI Act compliant?
No tool can do that alone. Approvals records the human oversight evidence that Article 14 asks for, in a form your compliance team and auditors can check.
Where is our data stored?
In the US by default, with an EU region on Enterprise. Sealed fields are encrypted with your key before they reach us, and only your approvers' browsers can read them.
Give your agent its first real job this week.
One tool call, one rule and a Slack channel. The quickstart is built to get you to a first decision in under ten minutes.