Pages
Policy Config — Require Tool Approval
Source: c65 policy-definitions.md P4 — toggle + exceptions shape
‹ Policy Catalog
Require Tool Approval
Consequential tool calls require a human approval before agents proceed. The human-oversight anchor — EU AI Act Art. 14 and ISO 42001 oversight evidence hang off this policy.
Action & Autonomy
medium
P4Satisfies
OWASP LLMOWASP ASIISO 27001ISO 42001SOC 2EU AI Act
OWASP LLMOWASP ASIISO 27001ISO 42001SOC 2EU AI ActUnderlying control— show
run: approval_policy = "never"edit as custom control →4 never-ask runs in the last 24h
3 from nightly-etl (covered by exception) · 1 from scratch-agent-jm — the human-oversight evidence for EU AI Act Art. 14 and ISO 42001 hangs off this policy.
Exceptions
Scoped carve-outs with a reason and an expiry — accepted risk, on the record.
| Scope | Value | Reason | Expires | |
|---|---|---|---|---|
| agent | nightly-etl | Unattended batch pipeline — reviewed 2026-07-02 | 2026-12-31 | |
Remediation shown on findings: Set the agent's approval policy to on-request or always; route unattended work through a reviewed exception.