Approve the exact operation, once.

REQUIRE_APPROVAL pauses a tool before execution and creates a time-bounded dashboard request.

Resume after review

try:
    agent.tools[0](invoice_id="INV-100", amount=250)
except ApprovalRequired as pending:
    wait_for_review(pending.approval_id)
    with security.resume(pending):
        agent.tools[0](invoice_id="INV-100", amount=250)

Integrity rules

Tenant, agent, action, resource and canonical arguments must match. Changed, expired, denied, already-consumed or replayed approvals fail closed.