D
Dezifi.ai
Guide

Approvals

List the tools that must wait for a person in the agent's policy. The agent pauses, an approver sees the exact arguments, and the call runs only if they approve.

Choose the tools that need approval

In the agent's policy, list the tools under approvalRequired and say who may approve (roles or emails) and how long they have:
policy (DAK, TypeScript)
new Policy(stack, 'Policy', {
  policyName: 'ops-triage-policy',
  enforcement: PolicyEnforcement.HARD,
  capabilities: {
    tools: {
      // Catalog tools are named integration:action; your own API tools as custom_<toolName>.
      approvalRequired: ['linear:create_issue', 'linear:update_issue', 'custom_request_refund'],
      approvers: { roles: [ApproverRole.OWNER, ApproverRole.ADMIN], timeout: Duration.hours(24) },
    },
  },
});
Patterns accept * (for example linear:*). An approval nobody decides in time is treated as rejected (24 hours unless you set timeout); it is never approved by default.

What the end user sees

While the call waits, the chat says: "Awaiting human approval — a team member needs to approve this before I can continue. The answer will appear here." After a decision the conversation continues in the same session. In the SDKs, a paused turn ends with onPaused (TypeScript) / on_paused (Python).

Decide in the dashboard

  1. 1

    Open the request

    Approvals lists pending requests (Assigned to me or All), with the end user and customer they are for. Open one to Review & respond.
  2. 2

    Approve

    Optionally add a note, then Approve. The tool runs as the end user who asked, never as the approver.
  3. 3

    Reject, and tell the customer why

    A Note is required to reject; it is internal and never shown to the customer. To tell the customer something, fill in Message to the customer if you reject (up to 2,000 characters). Without it they are told only: "A team member reviewed this request and could not approve it, so it was not carried out."

Decide by API

POST /api/v1/hitl/tasks/{taskId}/approve with an optional note, or /reject with a required reason and an optional customerMessage. The key needs hitl:approve or hitl:reject.
reject with a customer message
curl -X POST https://api.dezifi.ai/api/v1/hitl/tasks/<taskId>/reject \
  -H "Authorization: Bearer <secret key with hitl:reject>" \
  -H "Content-Type: application/json" \
  -d '{
        "reason": "Duplicate charge was already refunded on 3 Oct.",
        "customerMessage": "This charge was already refunded on 3 October. It can take 5 to 10 business days to appear."
      }'