# approveAgentAction

Approve or decline a change an agent proposed (a pending approval from askAgent, delegateToAgent or getAgentRun). Only the people it was sent to may decide it (the person who asked for the job; for a duty, its owner and backup approvers), and only while they can read what the job read: anyone else on its list is refused, and an approval they may not review comes without its content (mayReview false). Approving lets the job continue: this call waits up to 20 seconds and answers with the job's outcome and receipt if it settles in time, or its progress to follow with getAgentRun. Through a connection that reaches less than you do, the outcome comes back only for a job started through that same connection; any other approval it may decide is answered with the decision alone. The change runs as the agent, still within the rights of the person who started the job. Declining cancels the job with your reason. A plan approval (kind: plan) approves or declines the whole plan at once; only someone who can see every step's item may decide it, it expires after 24 hours and it is used once. Pass the plan's digest (getAgentRun plan.digest) to be sure you approve the plan you reviewed: a different digest is refused and nothing is decided.

Agent View of the PolicyLayer registry record for `approveAgentAction`. HTML page: https://policylayer.com/tools/io-stablebaseline-sb/approveagentaction

## Facts

- Tool: `approveAgentAction`
- Server: Stable Baseline (`https://api.stablebaseline.io/functions/v1/cloud-serve/mcp`) — https://policylayer.com/tools/io-stablebaseline-sb.md
- Homepage: https://github.com/stablebaseline/mcp
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server CORS policy: https://app.stablebaseline.io
- Server rate-limited: no
- Parameters: 4 (2 required)
- Recommended policy verdict: Rate-limited

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `digest` | string | no | Optional, plan approvals only. The plan's SHA-256 digest from getAgentRun `plan.digest`; the decision is refused with plan_digest_mismatch when it differs. |
| `reason` | string | no | Optional reason, recorded with the decision (shown when declining). |
| `decision` | string | yes | Your decision. |
| `approvalId` | string | yes | The pending approval id. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "approveAgentAction",
    "arguments": {
      "decision": "<decision>",
      "approvalId": "<approvalId>"
    }
  }
}
```

## Why approveAgentAction is rated Medium

An AI agent can call approveAgentAction faster than any human can review: one bad instruction and it creates or modifies resources in Stable Baseline by the hundred, each call as confident as the last.

Risk signals: Bulk/mass operation — affects multiple targets

## Use case

AI agents use approveAgentAction to create or update resources in Stable Baseline, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Stable Baseline environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Stable Baseline:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "approveAgentAction": {
      "limits": [
        {
          "counter": "approveagentaction_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Stable Baseline (221)

- `autoDesignWhiteboard` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/autodesignwhiteboard.md
- `cancelAllKgInScope` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/cancelallkginscope.md
- `cancelKgBuildBatch` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/cancelkgbuildbatch.md
- `delegateToAgent` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/delegatetoagent.md
- `deleteDatabase` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletedatabase.md
- `deleteDatabaseRows` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletedatabaserows.md
- `deleteDiagramInDocument` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletediagramindocument.md
- `deleteDocument` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletedocument.md
- `deleteFolder` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletefolder.md
- `deleteImageInDocument` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimageindocument.md
- `deleteImprovement` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimprovement.md
- `deleteImprovementCategory` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimprovementcategory.md
- `deleteImprovementComment` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimprovementcomment.md
- `deletePlan` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteplan.md
- `deletePlanComment` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteplancomment.md
- `deletePlanPhase` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteplanphase.md
- `deleteResourcePermission` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteresourcepermission.md
- `deleteTaskDependency` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletetaskdependency.md
- `deleteTeam` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteteam.md
- `deleteVegaDataFile` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletevegadatafile.md
- `deleteWhiteboard` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletewhiteboard.md
- `getAgentRun` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/getagentrun.md
- `previewKgScopeChange` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/previewkgscopechange.md
- `previewSubscriptionChange` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/previewsubscriptionchange.md
- `removeMember` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/removemember.md
- `removeTeamMember` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/removeteammember.md
- `removeWorkspaceMember` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/removeworkspacemember.md
- `reorderDocuments` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/reorderdocuments.md
- `resetDocumentInBrain` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/resetdocumentinbrain.md
- `revokeTeamWorkspaceAccess` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/revoketeamworkspaceaccess.md
- …and 191 more: https://policylayer.com/tools/io-stablebaseline-sb.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-stablebaseline-sb · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-stablebaseline-sb