Approvals
Some actions are too consequential to run unattended — a refund, a production deploy, rotating a secret. Permaura lets you pause exactly those for a human, without slowing down the routine ones.
The approval ladder
Every action a policy governs sits at one of five rungs. You choose the rung per action, per connection.
| Rung | What happens |
|---|---|
| Allow | Runs immediately. |
| Notify | Runs immediately, but you're told it happened. |
| Approve | Pauses until a human approves or denies it in the console. |
| Device-signed | Pauses until approved and cryptographically signed on an enrolled device. |
| Deny | Never runs. |
Set these on a connection's policy. Everything defaults to deny until a grant says otherwise, so you're always opting actions in, never trying to remember what to lock down.
The queue
Anything at Approve or Device-signed lands in Control → Approvals. Each request shows the agent, the exact action and connection, and the arguments, and each is single-use and time-boxed — approve it and that one call proceeds; ignore it and it expires.
Device-signed approvals
For your highest-risk actions, a click in a browser isn't enough. Device-signed approvals require a signature from a phone you've enrolled, so that even a compromised gateway can't forge an approval — the signing key lives only on your device, and the gateway merely verifies it.
- Enrol a phone under Workspace → Devices (pair it once).
- Mark the action Device-signed in its policy.
- When an agent triggers it, your phone gets a push. Approve with Face ID / Touch ID and the phone signs the result; the gateway checks the signature before the call runs.
An enrolled phone is an approver, not a place your secrets run. It holds a signing key and answers yes/no — nothing more.
Two-person approval
On Enterprise, an action can require two different people to approve before it runs — the standard control for irreversible or high-value operations. Configure it per policy.
Getting notified
Pending approvals surface as a badge on the Approvals item in the sidebar and in the top bar, so a waiting request is always one glance away. Device-signed requests also push to the enrolled phone.