Approvals on Hub

Permissions gate risky agent actions behind human approval. The policy engine, the modes, and the corsair_permissions table work the same on Hub. Hub hosts the approve/deny UI, so you do not build a review page.

How it works on Hub

The authoritative approval record lives in your corsair_permissions table. Hub renders the UI and delivers the signed decision to your handler, which writes the outcome to your database. Hub never touches your database. To render the review screen and route the decision, Hub does keep a short-lived session of its own holding the plugin, endpoint, the call arguments shown for review, and the tenant id, until the request is decided or expires. Delivery uses the same environment-specific transport as connect flows: a signed POST over the Corsair tunnel in development, a signed POST to your public URL in production.

Configuration

With hub configured, blocked calls include a hosted approval URL with no extra setup:

corsair.ts

export const corsair = createCorsair({
    plugins: [
        github({
            permissions: {
                mode: "cautious",
                overrides: { "repositories.delete": "deny" },
            },
        }),
    ],
    database: db,
    kek: process.env.CORSAIR_KEK!,
    permissions: {
        timeout: "1h",
        onTimeout: "deny",
        mode: "asynchronous",
    },
    hub: {
        projectApiKey: process.env.CORSAIR_API_KEY!,
        signingSecret: process.env.CORSAIR_SIGNING_SECRET!,
    },
});

Approvals require the corsair_permissions table. That table is your system of record; Hub only holds the pending session while the review is open. See Permissions for the migration.

What’s next

Permissions

Policies, modes, overrides, and the full approval lifecycle.

Hub overview

The relay model and the surfaces Hub hosts.

MCP adapters

How approvals gate agent tool calls.

Get Started

Frameworks

Adapters

Workflows (beta)

Reference

Approvals on Hub

How it works on Hub

Configuration

What’s next

Permissions

Hub overview

MCP adapters

​How it works on Hub

​Configuration

​What’s next

Permissions

Hub overview

MCP adapters

How it works on Hub

Configuration

What’s next