Skip to content

Approvals and safety

The server decides which actions need approval, with the same rules as the web app. Approvals and policies explains them. This page covers what changes when you drive SARA from the CLI or the SDK.

The approval model

  • A workflow stops with status: "awaiting_approval" and lists its pending_approvals. Each one has a type (bash_command or plan), the command or plan, and a reason.
  • Review the pending action before you decide.
  • Approve only the exact command or plan you reviewed. Reject anything outside the scope you agreed to.
skyportalai --json chat status 123

skyportalai chat approve \
  123 APPROVAL_ID \
  --type bash_command \
  --command "EXACT REVIEWED COMMAND"

skyportalai chat reject \
  123 APPROVAL_ID \
  --type bash_command \
  --reason "Outside the approved scope"

For the SDK, see Approvals in the Python SDK.

Your account's approval mode

Your account has one approval mode: Ask (the default) or Auto-approve. The web app, the interactive terminal and the SDK share it.

Where How to change it
Web app Chat ⚙ menu, Action Approvals
Interactive terminal /permission ask or /permission autoapprove
Python SDK client.set_permission_mode("ask") or "autoapprove"

With Auto-approve, these clients approve each pending command and plan for you instead of stopping:

  • the web app, while the chat is open in a browser tab;
  • the interactive terminal;
  • skyportalai chat send --wait and skyportalai chat wait;
  • the SDK's wait() when you don't pass an on_approval callback.

Automatic decisions are recorded as automatic in the audit trail.

Auto-approve answers destructive prompts

Auto-approve approves every command and plan that reaches an approval card. That includes destructive commands on Staging, Dev and Custom hosts, reading Kubernetes Secrets, kubectl exec, deleting a namespace, file edits and commands that run on many hosts at once.

Auto-approve can't get past these limits:

  • destructive commands on hosts whose environment is read-only (Production, by default);
  • commands your team role doesn't allow;
  • commands blocked by a repository deny list;
  • hosts outside the chat's scope;
  • agent token requests, which always ask.

Turning on Read-Only Mode in the web app switches the approval mode back to Ask.

Keep Ask for anything that can reach production. Use Auto-approve only for environments you can rebuild.

Connection safety

Every authenticated request carries your credential, so the clients check the target before they send anything.

  • Remote targets must use HTTPS. Plain HTTP is allowed for localhost, 127.0.0.1, ::1 and *.localhost.
  • URLs with embedded credentials, query strings, fragments, malformed ports or non-HTTP schemes are rejected.
  • SKYPORTALAI_ALLOW_INSECURE=1 allows plain HTTP to another trusted host and prints a warning.
  • Authenticated requests use root-relative API paths, so the credential is never forwarded to another origin.
  • The interactive terminal does not follow redirects on authenticated requests.
  • On Linux and macOS, the CLI writes credentials.json, the input history, the last-chat file and a config.yaml saved by config set so that only your user can read them. Files left by an older version keep their permissions until they are written again.
  • The CLI refuses agent tokens (agt_). They only work for the observability agent.

Warning

Never include real API keys, access tokens, approval IDs, hostnames or private infrastructure data in examples or logs.

Safe examples

Use low-risk prompts in examples and tests:

  • "Report disk usage and identify the largest directory."
  • "Inspect the previous job logs."
  • "Check API connectivity."