Approval Gates

Approval gates are the central safety invariant in AI Intern. Autonomous agents are never permitted to clone private code, execute terminal commands, or push git branches without explicit human verification.

Why Approval Gates Matter

Autonomous coding agents need shell execution, file writes, and package installations to solve real engineering problems. However, granting unconstrained access introduces critical security and stability risks:

• Destructive Commands: Preventing inadvertent rm -rf, branch force-pushes, or schema drops.
• Malicious Dependency Ingestion: Verifying that newly added packages originate from trusted registries.
• Scope Creep: Ensuring the agent restricts edits strictly to the requested feature or bugfix.
• Cost Controls: Reviewing projected compute and token usage before launching heavy tasks.

Approval Channels

AI Intern provides three synchronous approval mechanisms:

1. Slack Interactive Block Kit

When an agent formulates a plan, it sends a formatted Slack Block Kit card directly to the originating thread:

{
  "type": "section",
  "text": {
    "type": "mrkdwn",
    "text": "*Delegation Plan:* Fix input sanitization in `src/auth.ts`\n*Target:* `main` branch\n*Commands:* `pnpm test -- auth.test.ts`"
  },
  "accessory": {
    "type": "button",
    "text": { "type": "plain_text", "text": "Approve Run" },
    "style": "primary",
    "value": "run_01a0b4cd"
  }
}

Clicking Approve immediately unblocks the Durable Object workflow and provisions the Cloudflare Sandbox container.

2. Web Dashboard Review Modal

The self-hosted dashboard at /app displays pending approvals with:

• Target repository and branch
• Planned shell commands
• Estimated compute duration
• One-click Approve or Reject with Reason actions

3. REST API & Webhooks

For CI/CD pipelines, approval decisions can be submitted programmatically:

curl -X POST https://your-worker.workers.dev/api/runs/run_01a0b4cd/approve \
  -H "Authorization: Bearer ${ADMIN_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"approved": true, "reviewer": "octocat"}'

What Happens When Rejected?

If a developer rejects the proposed plan, the Captain agent records the rejection reason, aborts container provisioning, and notifies the team. No container is launched, and no git changes are made.