Cookbook

How to add human approval to any AI tool call

When governance blocks a tool call, Cadreen returns a conversational prompt instead of executing. No custom approval UI needed — the AI asks, the human answers.

How the approval flow works

The model proposes a tool call. Cadreen evaluates it against your policies. If the policy requires approval, Cadreen returns a conversational prompt instead of executing the tool.

What the user sees

In opencode, Cursor, or any chat surface — the approval prompt is just a message:

Conversational blocking

> Refund $500 to customer 12345

I need your approval before I can process_refund.

Your workspace policy requires human approval for refunds over $100.
The refund amount is $500.

Say "yes" to proceed or "no" to skip.

> yes

Done. Refund of $500 processed for customer 12345.
Refund ID: re_abc123

Note

The approval is fast-path: "yes", "y", "confirm", "approve", "ok", "go ahead", "do it" all work. For cancel: "no", "n", "skip", "cancel".

Handle approvals in your SDK code

When using the SDK, the response tells you if approval is needed:

TypeScript

try {
  const result = await cadreen.intent.invoke({
    messages: [{ role: "user", content: "Refund $500 to customer 12345" }],
  });
  // result.type === "answered" — governance approved
} catch (error) {
  if (error instanceof CadreenBlockedError) {
    console.log(error.reason_code);  // "requires_approval"
    console.log(error.policy_id);    // "pol_refund_threshold"
    // Show the user the approval prompt, then retry
  }
}

Python

from cadreen import CadreenBlockedError

try:
    result = await cadreen.intent.invoke(
        messages=[{"role": "user", "content": "Refund $500 to customer 12345"}],
    )
    # result.type == "answered" — governance approved
except CadreenBlockedError as e:
    print(e.reason_code)  # "requires_approval"
    print(e.policy_id)    # "pol_refund_threshold"
    # Show the user the approval prompt, then retry

Under the hood: the approval token

When a human approves, Cadreen issues an HMAC-SHA256 signed approval token. It's scoped to the exact action, parameters, tenant, and mission. It expires in 1 hour. It can be revoked.

Approval token structure

{
  "token_id": "tok_abc123",
  "mission_id": "mis_xyz",
  "workspace_id": "ws_123",
  "action": "process_refund",
  "parameters": {"amount": 500, "customer_id": "12345"},
  "approved_by": "user:456",
  "approved_at": "2026-06-21T10:30:00Z",
  "expires_at": "2026-06-21T11:30:00Z",
  "signature": "a1b2c3d4..." // HMAC-SHA256
}

Note

Every token is cryptographically verified — signature, expiration, revocation, scope, action, and policy version are all checked before approval is accepted.

Note

Next: Building self-healing tool chains — automatic failure recovery with precedent memory.