Approval policies

Tessel runs every session in a sandbox, but some actions reach outside it: pushing a branch, opening a pull request, calling a paid API. Approval policies decide which of those run on their own, which wait for a person and which are never allowed.

Policies live in tessel.toml next to your code, so they are reviewed like any other change. Workspace admins can add an org-wide floor that repositories can tighten but never loosen.

How approvals work

Before a tool call leaves the sandbox, Tessel matches it against your rules from top to bottom. The first rule that matches wins. When nothing matches, the default applies.

1. The agent proposes a call with its exact arguments.
2. Tessel looks up the decision for that tool and those arguments.
3. An ask decision pauses the session and shows an approval card in the workspace, Slack and the PR thread.

Risk levels

Each built-in tool carries a risk level that sets how the approval card looks and who may approve it.

Configure a policy

You need the CLI to validate a policy locally before you commit it.

Install the CLI

pnpm add -D @tessel/cli

Write tessel.toml

This policy lets Tessel run tests and builds freely, asks before anything touches main and blocks destructive shell commands outright.

# tessel.toml: committed at the repo root
[approvals]
default = "ask"            # ask | allow | deny

[[approvals.rule]]
tool = "github.create_pull_request"
when = { base = "main" }
decision = "ask"

[[approvals.rule]]
tool = "shell.exec"
match = "^(pnpm|npm) (test|lint|build)"
decision = "allow"         # safe, read-only commands

[[approvals.rule]]
tool = "shell.exec"
match = "rm -rf|git push --force"
decision = "deny"

Check it with tessel policy check. The command prints each rule with the calls from your last ten sessions it would have matched.

Remembered decisions

Choosing Always allow on an approval card writes a remembered rule scoped to the repository and tool. You can review and revoke remembered rules under Settings → Approvals.

Remembered rules never apply to high-risk tools. Those ask every time, by design.

Auditing decisions

Every decision is recorded with the approver, the arguments and the policy line that matched. Export the log as CSV, or stream it to your SIEM with the audit webhook.

• Logs are kept for 400 days on Team and indefinitely on Enterprise.
• Denied calls include the agent's next step, so you can see how it recovered.