Approval-as-an-API

Give your AI agents a human off-switch.

Seal pauses risky agent actions behind a policy and a one-tap human approval — with a tamper-evident audit trail for every decision. One SDK call. Fail-closed by default.

  • 01fail-closed by default
  • 02tamper-evident audit
  • 03one SDK call
Live approval gate
Gate interlockreq_8f2a1c
action
payments.transfer
$48,500.00 → acct_ff20…9c1
ARMED
LOCKED
ON
OFF

Drops into any agent stack

LangChainCrewAIAutoGPTn8nCustom loopsRaw API
1 call

to gate any agent action

1 tx

state + audit commit atomically

0

edit or delete paths on the log

1,000

free approvals every month

How it works

Three steps to a human in the loop

Wrap the call, a human decides, the verdict is enforced. Everything else in your agent stays exactly as it is.

STEP 01

Wrap the risky call

One line — gate.require() — around the action an agent shouldn't take alone. Everything else runs untouched.

await gate.require({
  action: "payments.transfer",
  policyKey: "payments.high_value",
  payload: { amount, to },
});
STEP 02

A human decides

The request routes to Slack (or the reviewer console) with full context: agent, policy, payload, confidence. Approve or reject in one tap.

STEP 03

The verdict is enforced

Approved → the call proceeds. Rejected or expired → it never runs. Unknown input → the safe verdict, always. Every step co-commits to an append-only audit chain.

Security posture

Every action, on the record. No exceptions.

A state change and its audit event co-commit in one transaction — status without audit, or the reverse, is impossible. The log is append-only by construction and by database guard: hash-chained, verifiable, with no edit or delete path, ever.

Default denyHash-chainedOrg-scopedZod at the border
Read the security model →
Audit chain · req_8f2a1c
created
sha256:3f9a…c2
escalated
sha256:a71b…4e
approved · ada@acme
sha256:d0c8…91
✓ chain integrity verified
Invariants

What you'd rather not hand-roll

F-01

Fail-closed by design

An unknown, missing, or malformed input yields the safe verdict — require_approval or deny — never the permissive one. Evaluation of untrusted input never throws.

F-02

Tamper-evident audit

State change and audit event co-commit in one transaction. The log is append-only by construction and by database guard — hash-chained, verifiable, no edit path, ever.

F-03

Policy, not hardcoding

Decide what needs a human by action, amount, agent, or scope. Change the policy without redeploying the agent.

F-04

Human-in-the-loop where humans are

Approvals land in Slack, the reviewer console, or your webhook. Reviewers act in seconds with keyboard-first controls.

F-05

Multi-tenant from the first row

Every request, key, and audit event is org-scoped. Scoped API keys, custom reviewer roles, least-privilege by default.

F-06

Built for agents, treated as hostile

Payloads are bounded and schema-parsed at the border. No implicit coercion, no ReDoS, no trust in an id alone.

Reviewer console · live queue
Escalated
database.drop_table
migration-agent
1:40
Expiring soon
iam.grant_role
onboarding-bot
0:52
Active
email.send_bulk
lifecycle
9:31
FAQ

Answers, up front

Q1What is approval-as-an-API?+

A hosted human-in-the-loop gate for autonomous agents. Instead of building approval UIs, queues, and audit logs yourself, you wrap a risky action in one SDK call and Seal handles routing it to a human, enforcing the verdict, and recording a tamper-evident audit trail.

Q2How is this different from building it myself?+

The hard parts are the invariants: fail-closed evaluation of untrusted input, a state change and its audit event committing atomically, and an append-only hash-chained log that can't be edited. Seal ships those correct by construction, plus Slack routing, scoped keys, and a reviewer console.

Q3What happens if a request times out or the input is malformed?+

It fails closed. An expired, unknown, or malformed request resolves to the safe verdict — the action never runs. The permissive path is never the default.

Q4Which agent frameworks does it work with?+

Any of them. Seal is a plain SDK call, so it drops into LangChain, CrewAI, AutoGPT, n8n, custom loops, or raw API calls — anywhere your agent is about to do something irreversible.

Q5Is the audit trail really tamper-evident?+

Yes. Every decision writes an append-only, hash-chained audit event in the same transaction as the state change. There is no update or delete path on the log, enforced in application code and by a database guard. You can verify the chain integrity at any time.

Q6How fast can I add it?+

Minutes. Install the SDK, create a gate with your API key, and wrap one action in gate.require(). The first approval can be flowing through Slack in a single sitting.

Get started

Ship agents you can actually trust.

Start free with 1,000 approvals a month. No card. The first one can be flowing through Slack in a single sitting.