Gatehouse
Sign inGet started
DocsUsing Gatehouse

Approvals

Hold risky calls for a person to approve, in the console or in Slack.

When a policy says Require approval, the agent's call waits while a person decides.

The Approvals queue

What approvers see

Each request shows who asked, which agent they used, the tool, the exact arguments (with secrets redacted), the policy that required approval, and how long is left. Approvers can add a note, which the agent receives with the result.

Who can approve

  • Members of the policy's approver group, or any admin or owner if the policy names no group.
  • Nobody can approve their own request. This holds in the console, Slack and the API.

If nobody decides before the timeout, the call fails with "expired". The default timeout is 5 minutes. Change it with GATEHOUSE_APPROVAL_TIMEOUT_MS.

For a one-person trial you can allow self-approval with GATEHOUSE_ALLOW_SELF_APPROVAL=true. Don't use it in production.

Approve in the console

Open Approvals. Pending requests are at the top, and the count shows in the sidebar. Click Approve or Deny.

Approve in Slack

Gatehouse posts each request to a Slack channel with Approve and Deny buttons, and updates the message when someone decides. It uses Socket Mode, so Gatehouse doesn't need a public URL.

  1. Go to api.slack.com/apps, click Create New App → From an app manifest, and paste the contents of slack/manifest.json from the Gatehouse repository.
  2. Install the app to your workspace and copy the Bot User OAuth Token (xoxb-…).
  3. Under Basic Information → App-Level Tokens, create a token with the connections:write scope (xapp-…).
  4. Invite the app to your approvals channel and copy the channel ID.
  5. Set these and restart Gatehouse:
SLACK_BOT_TOKEN=xoxb-…
SLACK_APP_TOKEN=xapp-…
SLACK_CHANNEL=C0123456789

Gatehouse matches the Slack user to a Gatehouse person by email address. Someone without a matching account, or without permission to approve, gets a private message saying so and nothing changes.

Approve over the API

curl -X POST -H "Authorization: Bearer $GATEHOUSE_TOKEN" -H "Content-Type: application/json" \
  -d '{"approve": true, "note": "Looks right"}' \
  https://gatehouse.yourcompany.com/api/approvals/<id>/decide