Guides
Approving agent requests
When Claude or a terminal in a workspace asks to add data or release outputs, you see what would change and approve or reject it.
App in development
On this page
The portal screens are in development. Their words and layout may still change; the commands behind the buttons are already built.
Inside a workspace, Claude and the terminal cannot add data or release outputs by themselves: they can only ask. A request runs only after you look at it and approve it. IDs, paths and numbers here are examples.
What waits for approval
- Needs approval: adding data and releasing outputs when the request comes from inside a workspace, that is from Claude or a workspace terminal.
- Needs no approval: running code, reading
/data, using the allowed internet, installing packages. What you do yourself in the portal, [Add data] or [Release outputs], also runs at once. - Scope inside a workspace: there, even an owner who is an admin has no admin rights, and requests from other workspaces are not visible.
Finding a request
- The link Claude gives you. After making a request, Claude tells you its approval link, which looks like
https://app.example.org/approve/a-0031. - [Approvals] in the menu. When requests are waiting, their number shows next to the menu item. Choose a request and press [Open to decide]. “Show closed requests” lists finished ones too.
- The “Requests” column of the workspace list. It shows how many requests a workspace has waiting; clicking it shows only that workspace's requests.
Reading the approval page
Request to add data a-0031
Claude wants to add data to this workspace.
- Workspace
ws-0012- Data to add
/tables/labs(4 files)
| When | Visible files | Who can see |
|---|---|---|
| Now | 1,252 | 4 of 31 people |
| If approved | 1,256 | 2 of 31 people |
Command to run
ws add-data ws-0012 /tables/labs Approving runs the command above once, as kim.
If files change or are added after the request, approving does not run it.
- Title. “Request to add data” or “Request to release outputs”, with the request ID.
- Who asked. For example, “Claude wants to add data to this workspace.” Requests from a workspace terminal say so.
- What changes. “Now” and “If approved” for the visible files (for a release, the files released) and for who can see. It is recomputed when you open the page, and says so if permissions changed after the request.
- Files to release. A release request lists each file with its size and the first 12 characters of its SHA-256, the reproduce script and what it replaces. Images can be previewed.
- Command to run. The exact command approval would run: “Approving runs the command above once, as kim.”
Approve and run, or reject
[Approve and run] runs the requested command exactly as asked, once, as you. Progress shows in the console under the screen. You cannot edit the command; if you want something else, reject it and ask Claude to request again.
ws add-data ws-0012 /tables/labs --approval a-0031 Added data: /tables/labs (1,256 visible files)Who can see this workspace's results: 2 of 31 people. Admins can always see.Condition: ehr_full and one of ct_research or imaging_allRan the approved request: a-0031 synapse approval reject a-0033 Rejected request: a-0033 When a request does not run
- A release whose files changed. “If files change or are added after the request, approving does not run it.” When that happens you see “Not run: the files changed after the request.” Ask Claude to request again.
- A request already decided. A request runs once. Trying again says “The request is already closed”.
- An archived workspace. Archiving a workspace rejects its waiting requests.
- An interrupted run. If the run could not finish, for example because the server stopped, you see “The run was interrupted; you can approve it again.” Work that already finished is not run twice.
- A run that failed. Read the reason: “Fix the problem, then approve again or reject.”
Each workspace keeps at most 10 waiting requests by default.
Why the server enforces approvals
Claude Code has its own confirmation prompts, but an agent can skip them by reaching the same action another way. So the approval is enforced by the server: a request is recorded there and runs only when you approve it in the portal.