Agent Approval Protocol

An open protocol for approving agent actions before they happen.

Get started · Documentation · Specification · Report an issue

Agents can write code, issue refunds, send messages and change production systems. Giving them that access means deciding which actions they can take on their own and which need approval.

Agent Approval Protocol (AAP) gives agents a common way to request approval before a tool call runs. An adapter connects the software running your agent to an approval provider, which can apply a policy, ask a person to review the action, or combine both.

One place for approvals across your agents

A coding agent on a developer's laptop, a support agent on an application server and an operations agent on a cloud VM can all use the same approval provider. Your team can manage approval policies, review requests and keep a record of decisions in one place.

The provider can let routine actions proceed automatically and hold riskier ones for review. For example, it might approve looking up a customer's order immediately, but require a person to approve a refund.

Because AAP is an open protocol, you can choose your agents and approval provider independently. Use an existing provider or build one for your own review process. The same protocol connects them.

How it works

1. The agent proposes an action. It calls a tool through the software running it.
2. The adapter requests approval. It captures the exact tool and arguments and holds the call before it runs.
3. The provider decides. It reviews the request and returns an outcome. The adapter allows the call only when it has a valid approval.

flowchart LR
    accTitle: Approval before a tool call runs
    accDescr: An adapter intercepts the agent's tool call and requests a decision from an approval provider. Only a valid approval allows the call to reach the tool.
    Agent -->|Tool call| Adapter[AAP adapter]
    Adapter -->|Approval request| Provider[Approval provider]
    Provider -->|Decision| Adapter
    Adapter -->|Approved call| Tool

For a refund, approval covers the exact payment, amount and currency, for one execution attempt. Changing the amount requires a new approval. If the request is denied, expires or approval cannot be confirmed, the adapter blocks the call.

The agent receives the tool's result or an explanation of why the call did not run. The adapter handles the approval process on its behalf. See the approval flow for more.

An adapter controls only the tool calls that pass through it. Your agent's existing permissions still apply, and other paths to the same service need their own controls. See adapter coverage and limits.

Get started

Choose an approval provider and get an instance token and its complete AAP URL. Then install the AAP CLI on the machine running your agent. It supports macOS and Linux on arm64 and amd64.

curl -fsSL https://downloads.agentapprovalprotocol.io/install.sh | sh

Follow the setup guide for your agent:

Claude Code · Codex · OpenClaw · Pi · Hermes Agent · DeepSeek Harness

Build with AAP

The version 1 specification defines how adapters and providers work together. The OpenAPI contract describes the HTTP API. Use these to add approval support to your agent or implement a provider.

The adapters are also available as a Go library. See the embedding requirements when using it in your own application.

To put an agent you build in Python or TypeScript behind approvals, use the SDKs. They cover LangGraph and Deep Agents, Pydantic AI, Google ADK, the OpenAI Agents SDK, the Claude Agent SDK, CrewAI, the Vercel AI SDK and Mastra. The source is in sdk/.

Contribute

Help improve the protocol, add an adapter or make the docs clearer. Open an issue to discuss a change, or see the contributor guide to get started.

License

Apache 2.0. Code, specification and documentation are open source. See third-party notices for included assets.