Approvals tab

The Approvals tab is the actionable counterpart to the SDK's permission system. When an operation hits cautious-mode policy and produces a pending permission record, this is where the human decides.

Three tabs

• Pending — pending, approved, executing statuses
• Completed — completed, denied, failed statuses
• Expired — expired status

Counts appear next to each tab label. Search filters across plugin, endpoint, tenant, and args.

Per-row actions

Pending records show two buttons:

• Approve — calls updateApprovalStatus(id, 'approved'); the runtime's polling layer picks up the resolution within 500ms
• Deny — sets status to denied; the original operation raises a denial error

Approved/completed/denied/failed/expired records are read-only.

Format

Each row renders as a card with:

• Status badge (color-coded by lifecycle stage)
• plugin.endpoint dot-path
• Tenant id + relative-time createdAt
• Pretty-printed args JSON
• Expires-at countdown (pending only)

Notes

The store is InMemoryPermissionStore from @fabricorg/integrations. Seed records cover the four interesting lifecycle states so the UI is populated when first opened.

Production deployments back this with a Prisma-backed PermissionStore that integrates with your auth/RBAC layer — typically the same SSO that gates the Studio itself.