Proposed specificationSource-located exemplarH2

Guardian approval reviewer

Review risky proposed actions.

JOIN POINTrisky_action_escalationRECORD STATUSCandidate · v0.1.0

UML class view

The proposed contract drawn as participant roles, received calls, and numbered dependencies.

Object interactions

The same roles and calls as a class collaboration and a numbered message sequence.

Object interaction diagram for Guardian approval reviewer, showing role collaboration and a numbered message sequence — FIG. P24 / OBJECT INTERACTIONS
Open full SVG Download PDF

Pointcut

Where the mechanism applies. All four dimensions belong to the proposed match, not just its vocabulary.

Context: A proposed tool action is classified as requiring review.
Trigger: Policy requests approval or an automated reviewer detects risk.
Structure: Review request, reviewer context, decision reason, and approve/reject/escalate path.
Effect: The action waits for and executes only after an accepted decision.

Protected contract

The obligation that clients, operators, and auditors should be able to rely on.

Requires: Proposed action identity, risk context, and authority source are available.
Ensures: The approval binds to the exact action and records the decision.
Invariant: Review cannot silently execute while pending or accept a different action.
Violation: Timeout, reviewer failure, or rejection blocks execution with a typed outcome.

Negative control

A post-hoc warning after execution is not an approval gate.

Variation & lifecycle

The hot spot is admitted only where the protected semantics survive.

Permitted variation

Human prompt, reviewer agent, policy guardian, callback, and resumable interruption.

Test obligation

Test approve, reject, timeout, altered arguments, nested action, and bypass.

Evolution question

Did confirmation evolve into action-bound interruption and resumption?

Prompt + code design

An illustrative prompt and a small design sketch for the proposed contract. Names and APIs are invented; this is not a repository excerpt.

PROMPT SKETCH

Escalate risky actions to a reviewer with the exact action identity and risk context. Bind the approval to that action hash, record the decision, and resume only the approved call.

CODE DESIGN / PYTHON

def escalate(action, reviewer):
    ticket = reviewer.request(
        action_hash=action.digest(),
        context=action.risk_context(),
        authority=action.authority,
    )
    if ticket.decision != "approved":
        return Denied(action, ticket.reason)
    if ticket.action_hash != action.digest():
        return Denied(action, "approval bound to different action")
    return action.execute()

Illustrative design sketch. Approval must name the action; a blanket yes is not an authorization record. This example is a teaching aid, not implementation evidence or a conformance claim.

Detection & matching

The frozen rule that retrieves this record, the canonical source exemplar, and the control that should stay unmatched.

Join point: risky_action_escalation
Source locator: Barbaste et al., §10.2, p. 36 (Codex, “Guardian, an LLM Approval Reviewer”); source label
Lexical cue: (?i)\b(?:guardian|approval[_-]?(?:request|callback|handler)|review[_-]?action|human[_-]?approval)\bFrozen expression, v0.1.0. A match is a retrieval cue, not a confirmed implementation.
Aliases: None
Canonical exemplar: openai/openai-agents-pythonsrc/agents/tool.py:1498Support: tests/test_function_tool_approval_arguments.py:1
Negative control: A post-hoc warning after execution is not an approval gate.

Scope-anchored review. pohe-agent analyze <repo> --pattern P24 anchors the cue to its enclosing declaration and checks a separate operational signature for all four pointcut dimensions. Missing roles and negative-control risks remain visible; a structural match is not E2/E3. Calibration report ↗

Repository files

Up to five public files retrieved by the frozen cue and pinned to the audited commit. A match is a place to inspect, not a confirmed implementation.

01openai/openai-agents-pythonsrc/agents/tool.py:1498CANONICAL SOURCE 02aaif-goose/goosecrates/goose/src/agents/state_machine/tool_approval.rs:97RETRIEVAL CUE 03anomalyco/opencodepackages/core/src/aisdk.ts:752RETRIEVAL CUE 04cline/clinesdk/packages/core/src/hub/runtime-host/hub-runtime-host.ts:1769RETRIEVAL CUE 05Darwin-Agent/HarnessXharnessx/processors/tools/tool_whitelist.py:27RETRIEVAL CUE

Evidence & provenance

Each layer answers a different question. Do not substitute retrieval for review.

Source-located exemplar

A concrete source anchor is available for this proposed record. It is one exemplar, not evidence that all repositories—or every contract field—conform.

Review boundary: this candidate and its specification come from an AI-assisted study. Independent human validation remains open.

ANY-EVIDENCE FAMILY COVERAGE22/36

61.1% of repository families in the frozen panel have at least one current cue, historical cue, or canonical source layer. This is not confirmed prevalence.

Current lexical-cue repositories: 21 / 41

Canonical source anchoropenai/openai-agents-python 86bd29878b30src/agents/tool.py:1498

Supporting surfacetests/test_function_tool_approval_arguments.py:1

Tool approval interruption and on-approval handler.

Exploratory retrieval cue Regex / v0.1.0

This expression is a discovery instrument only. A match is a retrieval cue—not a confirmed implementation, pointcut match, or contract proof.