EPIC: approvals interrupt for things that carry no consequence, and every interruption dead-ends the turn

[oxoxDev]

The problem

Ask an agent to generate anything and the operator gets a wall of approval cards — on the task card and in the Approvals tab — for calls that carry no consequence worth interrupting a person over. Reading a mailbox asks. Writing a scratch file asks. Listing a repository's pull requests asks.

That is not a rendering bug. Four separate design decisions compose into it, and each one is defensible alone:

1. The default tier parks every write and every external read. default_policy_mode() is supervised (src/company/types.rs), and no shipped preset except signals_opportunity_studio sets [policy] at all — so every company created from a preset, including the marketing one, runs supervised.
2. Under supervised, anything classified Reach::Consequence parks. That includes file_write, edit, apply_patch, memory_store, workspace_write, run_workflow, mcp_call_tool — and every Composio read.
3. A parked call is refused, not suspended. openhuman resolves RequireApproval inline and fail-closed: the tool call is blocked, the model is handed a refusal, and the turn continues without the result. Approving afterwards mints a single-use grant and the agent has to be re-dispatched to re-issue the same call. So each approval costs a round trip and the work visibly dead-ends in between.
4. There is no tier between the two extremes. supervised parks every consequence; full parks nothing but the always_approve list. An operator who wants "don't ask me to read things, do ask me before you send money" has no setting to express that — and cannot change the mode from the console at all, because [policy].mode is manifest-only.

What we want instead

The model Claude Code uses, which the team already lives in daily:

• Reads never prompt. Not local reads, not reads through a connected third-party account.
• Writes inside the agent's own sandbox never prompt. Scratch files, patches, the company's own memory.
• Only consequence that leaves the building prompts — pushing to a remote, sending mail or a message, publishing, spending money, moving cash, filing something, changing an identity.
• A prompt is a decision, not a dead end. Approving resumes the work rather than requiring the agent to be asked again.
• Consent persists. An operator who has approved a shape of call once should be able to say "and from now on" durably, the way an allowlist entry does — not re-approve it every card and not have it silently expire.

The rule of thumb from the request, stated exactly: any Composio write may ask; no Composio read should.

Why this should be cheap

Most of the machinery is already built and well-factored. src/policy/consequence.rs already declares every tool's reach explicitly, already has a coverage test that fails when a tool is undeclared, already reads Composio consequence from the action slug rather than the tool name, and already has ~660 provider-classified actions tagged Read/Write/Admin vendored with openhuman. The classification we need is present — it is the verdict attached to it that is wrong, plus a missing tier and a missing console control.

Sub-issues

Split so the cheap, high-value fix can land alone and the deep one can be scheduled honestly.

[M3gA-Mind]

Scoping pass over the whole cluster — verified against upstream/main @ 843d5c2. I have left a per-issue comment on each of the five sub-issues and on the six older cluster:approvals items; this is the roll-up.

All four mechanisms in "the problem" are confirmed at the line level

1. Default tier. default_policy_mode() → "supervised" at src/company/types.rs:589-591. ✅
2. Consequence parks under supervised. Reach at src/policy/consequence.rs:72-83; parks_under_supervision() at :92-94 is matches!(self, Self::Consequence); the Composio read branch returns Reach::Consequence at :411-415. ✅
3. Refused, not suspended. MAX_APPROVAL_REQUESTS_PER_TURN = 8 at src/harness/policy.rs:101. I also confirmed openhuman main still resolves RequireApproval fail-closed today, so the deep fix is genuinely upstream. ✅
4. No tier in between, and no console control. PolicyMode has exactly three variants (policy.rs:105-112), and policyMode / always_approve return zero matches anywhere in frontend/src/. ✅

The one thing I would add to the epic

The body says "most of the machinery is already built and well-factored", and that is true of the classification. It is not true of the tier. Adding PolicyMode::Auto forces a decision at three exhaustive match sites, and the third is the one that bites: autonomy_for() (src/harness/toolbelt.rs:184-190) maps PolicyMode onto openhuman's AutonomyLevel, which has no Auto. That mapping sets the exec-security tier for workflow tool_call nodes — so picking Full there would loosen shell execution for every workflow node on an auto company, which inverts the tier's contract. Details in #560.

Recommended order

Step	Issue	Why here
1	#470	Fixes the Composio fixtures. Until it lands, no test in this cluster reaches the classifier, so nothing below can be proven.
2	#559	The cheap, high-value fix. One branch of one function.
3	#560	Defines its read behaviour in terms of #559, so it cannot be reverted independently if built together.
4	#562	Ships once there is a fourth tier worth showing — though three options today is a defensible first cut and gives drowning operators an escape hatch sooner.
5	#563	Its first deliverable is a decision record, not code — it overturns the documented 7-day standing-grant ceiling.
—	#561	Runs in parallel. Its headline fix is an openhuman change; the pickable slice here is the silent-discard warning, which needs doing in two places (policy.rs:1406/:1432 and workflows/caps/mod.rs:425).

Two corrections worth folding in

• tests: Composio fixtures use a key the tool does not accept, so they exercise the unclassified path #470 understates itself — the fixtures are in 5 files (15 occurrences), not 4. It misses src/harness/brain.rs, which is the re-dispatch path.
• approvals: no durable allow rules, so consent given once must be given again #563 is partly built — StandingGrant already has a scope (approvals: a standing grant records a tool, so a Composio grant is broader than the sentence the operator agreed to #457) and Minted/Revoked/Expired events exist, so "listable and revocable" may be close to satisfied already.

Scope boundary worth stating in the epic

This epic makes approvals rarer. Three older issues in the same cluster make them correct, and they are not substitutes: #459 (a tool classified as a pure read shells out to git in an agent-writable directory — still unfixed on openhuman main, so a pin bump will not help), #460 (a workflow tool_call node consults no ApprovalPolicy at all), and #439 (the request queue is pool-wide). Shipping only this epic leaves those three holes and makes them less likely to be noticed, because there will be far fewer cards to notice them in.

[M3gA-Mind]

Sub-issue #560 (the auto tier) is in review as #604.

One decision was split out of it rather than landed: #605 — should auto become the default policy mode? It bears directly on this epic's framing, since the epic's complaint is that operators are interrupted by things carrying no consequence, and the shipped default is what decides how many of them ever see a better tier. #604 adds the tier but changes no existing company's behaviour.