Approving What Your Agent Does

Memory is what an agent knows. Approval is what it is allowed to do about it. This lesson is the line between a useful collaborator and a process that can hurt you on a Tuesday.

What a review request is

A request is not a chat message. It is a row in a queue with:

• the artifact — the note, document or draft under review
• the options — each with a one-line statement of its consequence
• your verdict — approved, changes requested, or under review
• the reason — a changes-requested answer must say why

The artifact itself carries the verdict afterwards. That matters: a future reader looking at the note sees the decision, not just a Slack thread that has scrolled away.

The loop

1. Agent calls glassy_request_review with the artifact and its options.
2. You open Reviews and see the queue, oldest first.
3. You pick an option. The consequence beside it is what you are choosing.
4. The agent polls glassy_get_review and acts on your answer.
5. It can glassy_withdraw_review if the work changed, or glassy_report_review_outcome when the task is done.

What should require approval

Action	Approval?	Why
Search, recall, graph traversal	No	Read-only, and the corpus is already yours
Create a private note or draft	Usually no	Reversible, and visible in your library
Publish to a public window	Yes	Public is public; the blast radius is not yours alone
Delete or overwrite	Yes	The one class of action a backup should not have to rescue
Send to another person	Yes	You are accountable for what leaves
Spend money, call a paid API	Yes	Cost is a consequence even when nothing breaks

The cloud boundary, stated plainly

The review queue needs an owner at a machine they control, so it is appliance-only. On our cloud the four review tools answer 403 FEATURE_NOT_AVAILABLE, and glassy_notify is withheld with them — five tools in all, named in the /api/capabilities manifest. That is a designed restriction, not a bug: when you want the approval lane, self-host. It is free with your account, and the same software runs there.

What’s next?

You have the whole loop: connect, ask, traverse, remember, approve. Two places to go from here — the plain-language page if you want the shape in one read, or GIVE-THIS-TO-YOUR-AI-AGENT.md if you want to hand the operating contract to an agent and let it work.