Approvals & Escalations

enforcement:
  deny_on: [egress_violation, fs_violation, missing_idempotency_for_side_effect]
  escalate_on: [egress_violation, fs_violation]

security:
  side_effects:
    approve_high_risk: true
    human_escalation:
      approval_strategy: human_quorum
      timeout_action: auto_reject
      min_approvals: 2
      min_rejections: 1
      required_roles: [security, ops]
      veto_roles: [security]
      approval_set_id: prod-reviewers

import { createEscalationManager } from "sec0-sdk/escalation";

const escalation = createEscalationManager({
  apiKey: process.env.SEC0_API_KEY!,
  controlPlaneUrl: process.env.SEC0_CONTROL_PLANE_URL,
  tenant: process.env.SEC0_TENANT_ID,
  timeoutMs: 5 * 60_000,
  pollIntervalMs: 2000,
  defaults: {
    ttlSeconds: 300,
    timeoutAction: "auto_reject",
  },
});

const { created, resolution } = await escalation.createAndWait(
  {
    content: outboundMessage,
    violation: "agent_guard_failed",
    message: "Approval required before sending",
    severity: "high",
    nodeId: "merchant-agent",
    agentRef: "run-42",
  },
  { timeoutMs: 120_000 },
);

import {
  createApprovalsBridgeTransport,
  createSec0Guard,
} from "sec0-sdk/guard";

const guard = createSec0Guard({
  mode: "dashboard",
  provider: {
    remote: {
      auth: { apiKey: process.env.SEC0_API_KEY! },
      source: { source: "control-plane", level: "middleware", scope: "base" },
    },
  },
  escalation: {
    waitForResolutionByDefault: true,
    timeoutMs: 5 * 60_000,
  },
  transport: createApprovalsBridgeTransport({
    bridgeUrl: process.env.SEC0_APPROVALS_BRIDGE_URL!,
    tenantId: process.env.SEC0_TENANT_ID!,
    bearerToken: process.env.SEC0_APPROVALS_BRIDGE_TOKEN,
    sharedSecret: process.env.SEC0_APPROVALS_BRIDGE_SHARED_SECRET,
  }),
});