Approvals

Agents that gate destructive actions can call session.approval.request({ reason, risk, timeoutMs }) to pause until a human responds. The CLI is the simplest way to resolve those requests during development and CI.

fh approvals

fabric-harness approvals [session-id] [--pending] [--state]
  [--url <deployed-app-url>] [--token-env <name>] [--tenant <id>]

List approval requests for a session. --pending filters to unresolved requests; --state includes the request's current state machine (timeouts, history of actions).

Against a deployed App, omit the session id to discover approvals across every session visible to the authenticated tenant:

fh approvals \
  --url https://your-app.databricksapps.com/api \
  --token-env DATABRICKS_APP_TOKEN

The remote path uses GET /approvals, which requires approval:read and is tenant-filtered. It does not require admin:read.

fh approve

fabric-harness approve <session-id> <approval-id> [--actor <id>] [--reason <text>]
  [--url <deployed-app-url>] [--token-env <name>] [--tenant <id>]

Mark an approval as approved. The associated session resumes as soon as the running agent (or worker) observes the resolution.

fh approve ask-1f4f... appr-7 --actor preetham --reason "Cleared by SRE"

# Deployed App: the authenticated principal becomes the recorded voter.
fh approve ask-1f4f... appr-7 \
  --url https://your-app.databricksapps.com/api \
  --token-env DATABRICKS_APP_TOKEN \
  --reason "Cleared by SRE"

fh reject

fabric-harness reject <session-id> <approval-id> [--actor <id>] [--reason <text>]
  [--url <deployed-app-url>] [--token-env <name>] [--tenant <id>]

Mark an approval as denied. The agent typically aborts the gated action and returns an actionable failure.

See also

• Building agents → Approvals
• Policies and approvals