An approval queue an agent could approve

PAN-102 began as a copy of an open-source control plane for running agents as teams. It came with approvals. A read of the upstream code found three things wrong with them.

The agent adapters skipped every permission prompt by default. Agents inherited the host’s environment, cloud credentials and GitHub token included. And in the default local mode, any request without a token was treated as the admin, so an agent could approve its own approval.

The queue was real. It held exactly as long as nothing asked it not to.

The hardened copy drops the skip flags, runs each agent in a sandbox with a scrubbed environment, and sends its traffic through a proxy that allows named hosts only and refuses any name that resolves to a private or metadata address. An approval needs a person.

A feature called approval is a claim. Read the code before treating it as a control.