[phyxan]

A decision that needed a person could only be refused, with a name attached. Workable for an assistant somebody is watching, useless for anything running on its own, which is most of what a guard is for.

The loop

agent-passport guard --policy treasury.json --ledger spend.jsonl \
  --approvals approvals.jsonl -- npx -y @stripe/mcp

The agent gets a refusal with a reference:

Waiting for a person: stripe.create_charge
2,500 USD is above the 1,000 USD threshold, so a person must confirm before commitment.
Request 4ad06d81 is recorded. Someone can answer it with:
  agent-passport approve 4ad06d81 --approvals approvals.jsonl
This call was not sent to the server.

$ agent-passport approvals --approvals approvals.jsonl

4ad06d81  WAITING
  stripe.create_charge  2,500 USD
  on cus_7
  amount.above-human-threshold
  asked 2026-09-26 18:35:31, window closes 2026-09-27 02:35:31
  {"amount":250000,"customer":"cus_7"}

Answer it, and the same call goes through next time.

What an approval is worth

One exact call. What ties an approval to a call is the decision digest, taken over the subject, the authority and the request and over nothing else. It is the same digest that already stopped an action being swapped after approval, reused here. Change the amount by a penny, the customer, or any argument, and the approval stops matching.

Once. Spent when the call actually runs.

Until the window closes. The policy's slaHours. A decline is final.

A waiting request carries the arguments in full, which a receipt deliberately does not. Nobody can approve what they cannot see, and this file is the operator's rather than something handed to a counterparty.

Who may answer

Worth being blunt: an agent that can run a shell can also run agent-passport approve. A policy that lists approvers takes only answers signed by those keys:

"approvers": [{ "keyId": "approver-2026", "alg": "ed25519", "publicKey": "..." }]

An unsigned answer, one signed by a key the policy does not name, and one edited after signing are all refused. Without that list anything in the file counts, which is safe only where the agent cannot write to it, and the docs say that rather than implying the feature is stronger than it is.

The Claude Code hook honours an approval that already exists but opens none of its own, because Claude Code can put the question to the person directly.

Verification

8 new tests driving the real CLI, 129 in total. Harness and end-to-end scenario green. Mutation-tested seven ways, each reddening exactly its case:

Break	Result
Skip the digest comparison	"one exact call" red
Spend an approval twice	"good once" red
Reopen a decline	"stays declined" red
Accept an unsigned answer	"approvers" red
Never verify the signature	"edited afterwards" red
Accept a key the policy does not name	"approvers" red
Never mark an approval used	"good once" red

🤖 Generated with Claude Code