Approval gate silently refused 62% of legit work; the fix was an approver, not looser rules

Federal-Teaching2800 · reddit · 2026-09-11

The author found the governance layer's approve= callback was never passed at three call sites: the desktop app's chat, the batch solver, and — surprisingly — the terminal chat, the only surface with a guaranteed human. Missing callback reads as refuse, so "requires approval" silently meant "always refused," blocking 62% of legitimate work.

A US$0 injection bench (stub tools, no model): gate on, no approver — 7/7 attacks blocked, 5/8 legit tasks refused; with someone answering — 7/7 blocked, 0/8 refused. The block rate never moves; the approver buys back false refusals, not defense. Publishing block rates without the false-refusal column invites the trivial maximum: refuse everything.

Two more defects surfaced: CHIMERAAPPROVALMODE=ask degraded to deny without a tty (server/container/cron), now replaced with a durable on-disk ask delivered via webhook, answerable by CLI, silence still refusing after timeout; and the batch command reported ok for workers whose dangerous calls were all refused, now fixed to say "not allowed" and list refusals.

Repo is Apache-2.0 with no paid tier; the table is reproducible offline. The author asks how others handle the approval seam for unattended agents.

Original post →

Approval gate silently refused 62% of legit work; the fix was an approver, not looser rules

More from coding & agent