Yours to decidelit; inspect, deny, approve; approving for the session extends the mandate
ApprovalTWR-APR-0391 Needs approval

git push origin main

repoacme/api fromhgr/fix-flaky-auth files3 diff+42 −17
Requested by
HGR-3MX9 codex, for Sean, 41 min ago
Policy
require-approval-main-push cedar 
// hold pushes to main until a reviewer approves
forbid (principal, action == Action::"git:push", resource)
when   { resource.ref == "refs/heads/main" }
unless { context.approval.granted };
Checks
  • tests 212 of 212
  • lint clean
  • no secrets touched
Expires
in 54 min, then the push is dropped
reviewerplatform-oncall

For this session extends the mandate: codex may push to main until the session ends, in 2 h 10 min, and the grant is filed as TWR-GRT-0A12. Each push still gets a receipt.

PNPO 1 of 2 approved approvedPriya, 14:02 waitingyou, for platform-oncall
Your decision is filed as receipt TWR-RCPT-88A1
Deny with a reasonrequired; the field stays neutral until Deny is pressed with it empty
ApprovalTWR-APR-0392 Needs approval

curl -X POST https://api.stripe.com/v1/refunds

amount$1,240.00 chargech_3Qx…88231 policyrefunds-over-500-need-a-person
Denial and reason are filed as receipt TWR-RCPT-88A2
Edit, then approvethe arguments become editable; what runs is your version
ApprovalTWR-APR-0393editing Needs approval

gh pr merge 412

repoacme/api asked byHGR-3MX9 checks9 of 9
revieweryou
Filed as receipt TWR-RCPT-88A3, with your edit as a teaching
Waiting on othersa quorum not yet met and not your turn stays grey
ApprovalTWR-APR-0394 Waiting on 2 others

deploy api@2.14.0 to prod

envprod policyprod-needs-three-approvers expiresin 3 h
SKMLRM 1 of 3 approved yoursin, 13:48 waitingMarcus, release-managers
Nobody here is needed. You will be told when it is decided.
Decidedverdict rows; a denial carries its reason
Denied curl -X POST https://api.stripe.com/v1/refunds Refund the original charge, not a new one. Reason by Sean. policyrefunds-over-500-need-a-person receiptTWR-RCPT-88A2 14:07:40
Approved gh pr merge 412 --squash --delete-branch edited bySean receiptTWR-RCPT-88A3 14:12:05
Denied write secrets/prod.env policydeny-secret-paths sandboxHGR-9KD4 receiptTWR-RCPT-88A4 14:07:40
In a narrow placea docked panel or a phone, 320 px: the head wraps, the buttons share the line
ApprovalHGR-APR-8E7F Needs approval

git push origin main

repoacme/api policyrequire-approval-main-push expiresin 54 min
revieweryou
Filed as receipt TWR-RCPT-88A5