Approvals API
/api/approvals is Supabase-backed and is the one queue every proposed write or draft in SABLE
passes through — there is no side channel for an agent-proposed action to bypass a human.
GET /api/approvals
Lists approvals scoped to the caller. Supports filtering and paging (parseApprovalFilters,
parseApprovalPaging).
POST /api/approvals
{ "action": "approve", "id": "approval-uuid" }
{ "action": "approve_and_execute", "id": "approval-uuid" }
{ "action": "reject", "id": "approval-uuid", "reason": "not needed" }
{ "action": "edit", "id": "approval-uuid", "payload": { "text": "Edited" } }
{ "action": "batch_approve", "ids": ["approval-uuid"] }
{ "action": "execute", "id": "approval-uuid" }
Only admin/lead can mutate or execute. canExecuteApprovalKind and
approvalExecutionFunction decide, per approval kind, whether an execute/approve_and_execute
call actually reaches an external system (today, only asana_task_create and the Calendar write
kinds do) or just changes the approval's own status.
Prompt-owned approval kinds get an extra gate
PROMPT_OWNED_KINDS = { prompt_update, prompt_base_update, skill_update }
These change what SABLE itself runs — including skills, since guidance held outside the base
prompt is still prompt content, and leaving it ungated would make the skills table a way around
the single-owner control rather than an extension of it. isPromptOwner (from _prompt_owner.js)
gates all three, independent of the general admin/lead check every other approval kind uses.
What each approval kind actually does on execute
| Kind | Effect |
|---|---|
asana_task_create | Executes an external write via asana-act (or calendar-act for calendar kinds) |
weekly_update, scope_change, sow_draft, client_readout, deliverable_release | Mutates only SABLE-owned portal tables |
prompt_update | Folds an approved learned rule into the live agent prompt |
email_draft, scope_flag, sow_estimate | Remain approval/audit records until their delivery paths are implemented |
Related draft/evidence machinery
Approving a deliverable-shaped approval (sow_draft, client_readout, scope_summary) also
triggers evaluateDraftReadiness and reconcileDraftEvidence — the readiness and citation checks
that back the Draft Workbench.
Where the code lives
sable-agents-demo/web/api/approvals.js,_approvals.jssable-agents-demo/web/api/_prompt_owner.jssable-agents-demo/web/api/_deliverable_authoring.js,_approval_evidence.jssable-agents-demo/web/api/_kickoff.js,_board.js,_propose_skill.jssable-agents-demo/trigger/approvals.ts—sable.approval.execute, the durable execution path