Pending actions lists the open asks across every agent, newest first, and the sidebar shows how many are waiting. It is the channel that works for every harness and every messaging surface a harness sits behind: an ask is a durable record with a URL, so the agent’s turn can end and you can answer hours later. When a call needs your answer and the harness cannot ask in place, the agent relays a link of the form https://…/pending/<id>?t=<token>. The token is a signature over the action, the agent that requested it and its expiry; it carries no payload and proves only that the link is the one Graft issued for that action. Opening it signed out sends you to sign in and back to the action. The link opens a small page, not the console: the one ask under Graft’s mark, with a link to Pending actions beneath it. Answer it and the page closes itself; a tab your browser will not close says Done and that you can close it. The agent picks your answer up on its next call, and the same action stays in Pending actions as the record. A link that does not open says why, and says that nothing has been approved or declined:
  • This link is not one Graft issued: the token does not match the action.
  • This link has expired: the ask outlived its day. The agent asks again if it still needs to.
  • This link was already used: the agent has taken the answer.
The same action is also reachable from the Pending actions list without the token, under your session.

​
The cards

Every card reads <agent> asks to …, with when it was asked and when it expires, and offers Decline and an approve button. Once answered, it says what the answer means. Run a tool. <agent> asks to run vendor__name, with the tool’s badge (write or destructive), the connection and hosts it runs against, and the tool’s description quoted and marked written by the agent’s model. Approve records a yes that holds for this agent until withdrawn on its page; Decline records a no that holds the same way. The card carries a switch, Ask every time for this tool, off unless you have turned it on before: leave it off and your answer holds; turn it on with Approve and the tool asks you before each call until you turn it off, here or on the agent’s page. A destructive tool’s card says it can delete or overwrite data, and asks once like any other. Acquire against a connection. <agent> asks to acquire a tool against <connection>, with its hosts. Approving lets Graft’s model read from the connection through dry runs while it authors and publish what it builds into your toolbox; writes the tool later makes still ask on their own terms. Declining records nothing, and the next acquire asks again. Connect a vendor. <agent> asks to connect <name>, with the pre-filled form. The approve button says Connect. See Connecting a vendor. Re-enter a credential. <agent> asks to re-enter the credential for <name>, or reconnect for an OAuth connection, quoting what the vendor said in the agent’s words. The approve button says Save credential, or Reconnect. See Managing and revoking.

​
After you answer

If the agent’s call is still waiting, it resumes at once. If it has already returned awaiting_approval, tell the agent you have answered; it calls again with the same arguments, finds the answer, and proceeds without asking. An approved tool ask is consumed once and stands as the agent’s approval from then on; a declined one refuses that call and every later one until you withdraw it.

​
Changing your mind

Standing answers live on the agent’s page under Approvals: each tool, whether it is allowed or denied, when you decided, and whether it asks every time. Withdraw removes the answer, and the tool asks again on its next call; it is the way back from a no as well as from a yes. The Asks every time switch works in both directions on any allowed tool: on, the tool asks before each call; off, your answer holds. Build approvals are not listed. Revoking the connection removes them, along with every tool approval for its vendor, across all agents.

​
Try it