Policy countersign
A policy countersign is a rule that pauses an AI agent's action until a named person approves it, and records who approved it and when. It belongs on actions that are hard to undo, such as deletes, refunds or writes to production, so that a person sees them before they run.
An example
- id: orders-writes-need-approval
match: { tool: [orders.execute_sql, postgres.execute], agent: [claude-desktop] }
when: sql.writes
decision: require_approval
reason: Writes to the orders database need a person to countersign.
approval: { approvers: [role:admin], required: 1, expires_in: 30m }How Deedglass uses it
In Deedglass a rule can require approval instead of allowing or denying. The action waits; the approver sees the call and its arguments in Slack, email or the Console; their decision becomes part of the action's sealed record.