Pre-approve a narrow lane

What you get: fewer interruptions without giving up control. A standing grant pre-approves commands that match a narrow pattern, on one host, until it expires.

Only a human org admin can create or revoke a grant. An agent can never grant itself permission.

1. See the grants you have

active grants

$ quox approvals grants listSGR_5cd315bc391f815bea07  ssh_exec@hv-01  vmids 9100-9199  proxmox-test-vm-lane  uses 124  expires 2026-10-27T03:42:56.689Zreason: owner-approved zero-to-hero test VM lane 2026-10-13  (by 01KKNKG580E967VC6YKAFWRT27)

From a real run on our own install. Host name changed.

That grant lets agents clone, power and destroy test virtual machines numbered 9100 to 9199 on one host, and nothing else. It has been used 124 times, and it expires on its own. --all also lists revoked and expired grants.

2. Create one

Use a preset, or your own anchored patterns:

creating a grant

# a preset lane: test VMs in a fixed number range, cloned from one template$ quox approvals grants create --host hv-01 --preset proxmox-test-vm-lane \    --template 9000 --vmid-range 9100-9199 --days 14 \    --reason "release testing for two weeks"# or your own patterns: each one must match the whole command$ quox approvals grants create --host web-01 \    --pattern "^systemctl restart nginx$" --days 7 \    --reason "nginx restarts during the migration"

Commands as quox approvals grants create --help documents them at 0.3.0.

--days is 14 by default and 30 at most. A grant covers exactly one host.

What just happened

You moved a decision from “every time” to “within this lane, until this date”. Commands outside the pattern, on another host, or after expiry still stop and ask a human. The grant’s reason and author are kept with it, and its use count shows how often it was relied on.

Check it yourself

quox approvals grants list shows the use count climbing each time the grant is relied on.

Undo

Revoke it now, without waiting for the expiry:

quox approvals grants revoke <grant-id>