Skip to content

Require approval before widening app visibility - #2028

Open
16francej wants to merge 14 commits into
mainfrom
require-approval-widen-app-visibility
Open

16francej wants to merge 14 commits into
mainfrom
require-approval-widen-app-visibility

Conversation

@16francej

@16francej 16francej commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor

Agent-initiated changes that make an app public or share it with the whole organization now pause on the existing approval card instead of applying. Narrowing access needs no approval.

  • apps publish/share hold for a single-use approval when they would widen access
  • the share endpoints refuse widening from agent turn tokens
  • held approvals from scheduled tasks are delivered to the task owner
  • tests for each path

Builds on #2026; merge after it.

Joshua France and others added 14 commits October 3, 2026 07:13
Republishing, renaming or rolling back an existing app now ships code only. Requests that would change its audience or public setting are refused with a pointer to the share action, and default audience grants apply only on the first publish.
…n-app-visibility

# Conflicts:
#	test/agent-tools.test.ts
…into require-approval-widen-app-visibility

# Conflicts:
#	src/tools/primitives.ts
#	test/share-deployment.test.ts
…into require-approval-widen-app-visibility
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant