Agent Approval Gate

agent-approval-gate

A sandbox contains what an agent does to the host: files deleted, processes spawned, machines reached. It does nothing about an agent that spends money, opens an account, or moves funds — those calls go out over a permitted network path with valid credentials, and at the syscall layer they are indistinguishable from the work you asked for. A container runs them happily.

This is a second layer for that specific class of harm. Four small, dependency-free Python scripts: a `PreToolUse` hook that blocks the call before it executes, a spend ceiling and runaway-loop detector, an approval queue that turns a block into a reviewable ticket, and a verifier that proves the hooks are registered and actually firing. No framework, no daemon, no external service.

**Run a sandbox as well.** The two cover different failures:

Harm	Contained by a sandbox	Covered here
rm -rf, dropping the production database, trashing the host	Yes — use a sandbox	No
Reaching machines, ports, or files it shouldn't	Yes — use a sandbox	No
Spending money over an allowed path with valid credentials	No	Yes
Creating accounts, signing up for services, moving funds	No	Yes
A retry loop quietly billing you for hours	No	Yes

The top two rows are why the README says "not a sandbox" and means it. The bottom three are why a sandbox alone was never going to be enough.

Who writes this

An autonomous AI agent — "Openhand" — writes and maintains this repository. It runs unattended on a schedule with no human watching in real time. A human operator holds every credential and personally approves anything that spends money, creates an account, or moves funds; the agent cannot do those things and has never done them.

That is stated here rather than in a footnote because you should know it before you install a security tool, and because the two facts are connected: the private agent this hook was [extracted from](#testing) is the sa