Approvals and policies
What an approval is
An approval is a passkey signature over the exact content of a request: for a release, the artifact hash; for a certificate, the request; for a key piece, the box that receives it. The approval travels with the signing request, and Roost refuses the request when it is missing or does not match.
Approvals
| Request | Detail | Seals | |
|---|---|---|---|
| Release 1.4.2 · code signing | Approve to sign build 842 | 1 of 2 | Approve with passkey |
| Issue certificate · api.acme.example | CA key · 2 of 3 security officers | 2 of 3 | Approve with passkey |
| Share key piece with backup box | ROOST-26-0003 joins the domain | 0 of 3 | Approve with passkey |
| Retire key version v1 | data-key · 0 records still on v1 | Done | Approved |
Policy rules
Rules are evaluated in order. A rule names the keys, who is asking (a person, an application or an AI agent, with exclusions), the action, and the effect: permit, deny, audit, a limit per hour, or approval required with how many seals.
Policy rules Record only
| # | Keys | Who | Action | Effect |
|---|---|---|---|---|
| 1 | release-signing | ci-runner | sign | Require approval |
| 2 | data-key-* | orders-api | unwrap | Permit · audit |
| 3 | data-key-* | agent: ledger-bot | unwrap | Permit · limit 200/h |
| 4 | ca-* | anyone except Security officers | any | Deny · audit |
| 5 | * | * | export | Deny |
Record-only mode
A new rule set can run in record-only mode: nothing is refused, every decision is recorded as if it were enforced. Review the records, then switch enforcement on.
AI agents
An agent has its own identity, never an application's credentials. It receives short-lived access to the keys and actions it needs, counts and amounts are capped, and risky actions wait for a person's passkey. Each record states that the agent acted, on whose behalf, and who approved.
Refusals say why
A refused request returns the standard error for its interface and a reason: which rule refused it and what would allow it, for example "approval required: 1 of 2 seals present".