Sign-offs

Your agent can tighten its own guardrails at once, but a change that loosens them waits for a workspace admin to approve it.

An agent may never loosen its own guardrails. When your agent, your CLI login or an MCP session asks to raise a limit, remove a budget, add an action or relax an approval policy, Anlyon does not apply the change. It records a sign-off request and answers 202 with a link. A workspace admin opens the link, reads what would change, and approves or rejects it. A change that tightens a guardrail applies at once, as before.

Why sign-offs matter

A coding agent that sets Anlyon up holds a credential that can change the rules it runs under. Without sign-offs, one mistaken or manipulated step can raise the refund limit it is held to, or turn off the approval that stops it. With sign-offs:

• The limits you set stay set. An agent can lower a limit or add a policy on its own. It cannot raise or remove one without a person saying yes.
• Setup still runs unattended. Most setup tightens or adds nothing risky, so it goes through. The few changes that loosen wait for one click from an admin instead of blocking the whole run.
• You see exactly what changes. Each request carries a plain diff, field by field, with the reason it counts as loosening.
• Every step is on the record. The request, the approval or rejection, a cancellation and an expiry are each an audit record.

What needs a sign-off

A change needs a sign-off when it loosens a guardrail and it comes from an API key, a CLI login, an MCP session or an end-user session token. A person signed in to the console applies changes directly.

Anything Anlyon cannot show to be tighter counts as loosening. A new setting counts as loosening until it is classified.

What your agent gets back

The route answers 202 Accepted instead of applying the change. Location and data.pollUrl name the request to poll.

{
  "success": true,
  "signOffRequired": true,
  "data": {
    "object": "sign_off_request",
    "id": "sor_V1StGXR8Z5jdHi6BmyT9q",
    "status": "pending",
    "operation": "impact_limit.update",
    "summary": "Raise impact limit \"Daily refunds\" from 500 to 5000 usd",
    "diff": "amount (loosens): Raises the limit.\n- 500\n+ 5000",
    "signOffUrl": "https://console.anlyon.com/sign-offs/sor_V1StGXR8Z5jdHi6BmyT9q",
    "pollUrl": "/api/v2/sign-offs/sor_V1StGXR8Z5jdHi6BmyT9q",
    "pollAfterSeconds": 5,
    "expiresAt": "2026-10-29T10:00:00.000Z"
  }
}

Give signOffUrl to a person. Then read GET /api/v2/sign-offs/{id} every pollAfterSeconds until status is no longer pending:

Asking for the same change again from the same credential returns the same pending request, so a retry never creates a second one.

Approve or reject a request

A workspace admin decides, in one of two places:

• The console. Sign-offs lists every request with its diff. Approve applies the change; Reject leaves everything as it is.
• The email. Each admin is emailed a link of their own. Opening it shows the change and decides nothing, so a mail scanner cannot approve it. Approving or rejecting is a button on that page.

Requests also reach your notification channels, such as Slack, with a link to the console.

No API key, CLI login or MCP session can approve a request, whatever its scopes, including the credential that asked. You can approve your own agent’s request from the console: the rule is about the channel, not the person.

Use it from the CLI, an MCP client or the SDK

anlyon actions declare refund-order --ungoverned --yes --wait 10m
# Needs a human's sign-off. A workspace admin must approve this change before it applies:
#   https://console.anlyon.com/sign-offs/sor_...
# Without --wait the command exits 15. With --wait: 0 when applied, 14 when it ends any other way, 9 when the wait runs out.

anlyon sign-offs list --status pending
anlyon sign-offs get sor_V1StGXR8Z5jdHi6BmyT9q --wait 10m
anlyon sign-offs cancel sor_V1StGXR8Z5jdHi6BmyT9q

import { Client, SignOffRequiredError } from '@anlyonhq/sdk';

const anlyon = new Client({ apiKey: process.env.ANLYON_API_KEY! });

try {
  await anlyon.impactLimits.update('lim_01JABCDEF', { amount: 5000 });
} catch (error) {
  if (!(error instanceof SignOffRequiredError)) throw error;
  console.log(`Ask a workspace admin to approve: ${error.signOffUrl}`);
  const decided = await anlyon.signOffs.wait(error.signOffId);
  console.log(decided.status); // applied, rejected, expired, cancelled or failed
}

from anlyon import Client, SignOffRequiredError

anlyon = Client()

try:
    anlyon.impact_limits.update("lim_01JABCDEF", amount=5000)
except SignOffRequiredError as error:
    print(f"Ask a workspace admin to approve: {error.sign_off_url}")
    decided = anlyon.sign_offs.wait(error.sign_off_id)
    print(decided["status"])

In an MCP client, a tool call whose change is held returns a normal result that starts with “A human must approve this change before it applies. Give them this link:”, followed by the diff. The agent can call wait_for_sign_off or check_sign_off with the request’s id.

Fix the errors you will meet

Related

• Approvals and policies: the approvals your agent’s calls wait for.
• Workspace defaults: the rules no default can change.
• Audit: the records each request leaves.
• Authentication and API keys: scopes and operator keys.