Integrate action authority

Conceptual quickstart

First integrations start in shadow mode. Humbleaf observes proposed actions, returns decisions and evidence, but does not block production until promoted. Talk to us before a production integration.

Sample authorize request (illustrative)

const decision = await humbleaf.authorize({
  actor: "support-agent-04",
  action: "merchant.refund.create",
  resource: "merchant_123",
  amount: 4800,
  currency: "EUR",
  policyContext: "refund-policy-v7",
});

if (decision.status === "ALLOW") execute();
if (decision.status === "DENY") block();
if (decision.status === "APPROVAL_REQUIRED") routeApproval(decision.approvalRoute);

Sample decision response

{
  "status": "APPROVAL_REQUIRED",
  "action": "merchant.refund.create",
  "actor": "support-agent-04",
  "reasonCodes": ["REFUND.AMOUNT_EXCEEDS_LIMIT"],
  "approvalRoute": "finance-approval",
  "approvalBinding": "single_use",
  "expiresAt": "2026-06-18T17:45:00Z",
  "decisionHash": "0x84…5696"
}

Three decision states

• ALLOW — Policy permits execution.
• DENY — Policy blocks execution.
• APPROVAL_REQUIRED — A named approver must authorize this exact action.

Evidence / receipt shape (public-safe)

• action — The exact action that was proposed
• policySnapshot — Rules in force at decision time
• actor — Who or what was recognized as acting
• riskContext — Advisory risk that triggered escalation, if any
• approval — Human decision bound to the action, when required
• decisionHash — Tamper-evident digest of the decision record

The same synthetic bundle at /proof/synthetic-evidence-bundle.json can be used as a fixture for replay testing — marketing proof and developer reality share one artifact.