What to expect when ORBIT asks you.

Your agent attempts an action. Guardian evaluates it against your Agent Policy. If the matching rule is set to Allow, the action proceeds; if it is set to Block, the action is blocked. If the rule is set to Ask me first, the action pauses and Guardian sends you an approval request.

An approval request is a question for you. Until you answer it, the governed hook path is waiting and the requested action should not proceed through that path.

The alert arrives as a browser notification when you have them enabled, and it opens in your ORBIT browser session. It carries the summary and a link to the approval page, where you make the decision. The summary reads like this:

ORBIT: your agent (Claude, hearth) wants to
delete 412 files in ./build/.

Why this matters: deleting many files at once
can be irreversible if the target is wrong.

Coverage: exact operation match.

Open to allow once, block, or allow this
kind of action for 10M / 30M / 1H.

If you don't decide in 2 minutes, ORBIT will
block and your agent gets back "blocked".

Open in ORBIT: o.grc/e/01HQ3XK

Each part is doing a job:

• The opener. Names the agent, the device, and the action in one sentence. The action is plain language sourced from your policy.
• Why this matters.One sentence on the consequence. From the rule’s catalog entry; the same string the cockpit shows on the rule detail page.
• Coverage.What Guardian actually knows about this action on your installed adapter. Think of this as the difference between “I saw the exact wrench turn” and “I heard toolbox noises from the garage.” ORBIT keeps the label honest: exact policy match, exact operation match, broad signal, audit-only observation, or not detectable on this adapter. The cockpit and API may also show the precise state names for reviewers (precise_canonical, precise_operation, broad_signal, audit_only, or not_detectable), but the human job is simpler: do not treat a fuzzy or missing signal like exact proof.
• The timeout. If you do nothing, the action is blocked. Stated explicitly so you know what silence means.
• The Open-in-ORBIT link. A short URL that opens this approval request in the product. It is owner-only and requires you to be signed in to ORBIT; it does not display receipt content to anyone else. Receipts themselves are shared as the .orbitproof file, not URLs. Open the link to review and decide.

Open the link in the alert to reach the approval page. There you have four choices:

• Approve once -- Allow this one action.
• Deny -- Block this one action.
• 10M / 30M / 1H -- Allow this kind of action for the next 10 minutes, 30 minutes, or hour (a time-bounded standing approval; see below).
• Freeze (on high-impact requests) -- Deny everything that agent currently has pending, in one move, with a reason you pick.

The decision is a deliberate click, not a free-text reply. That is on purpose: a fuzzy parser would let a confused or coerced answer pass as consent. The choice is explicit because the consequences are real.

Replying with a time band creates a standing approval: any action that would match the same rule, for the duration you picked, is allowed without re-asking. You do not get re-alerted for the same kind of action until the standing approval expires.

The longest one-tap standing approval from the alert is 1 hour; longer windows are locked behind stronger verification. The safety floor never enters a window: blocked categories stay blocked. Forever-changes happen in Rules, where you can set the rule’s verdict to Allow durably (and see the change in your policy). The alert is for time-bounded; Rules is for durable.

Active standing approvals show on /dashboard/approvals/active with a live countdown. You can revoke any of them from there; revoke takes effect immediately and the next matching action will ask you again.

If you do not reply within 120 seconds, Guardian blocks the action and the agent is told the action was blocked. The action does not proceed.

This is fail-closed by design. Silence is not consent. If you missed the alert because you were in a meeting, the worst case is your agent reports back that the action was blocked and you can retry it (or change the rule) when you are back.

The 120-second window is the launch default. Per-rule timeouts (so you can set a longer window for specific rules where you know you are slow to respond) are on the roadmap.

Two pages, one URL each:

• /dashboard/approvals/active shows currently-active standing approvals (the 10M / 30M / 1H grants you have made), with a live countdown and a Revoke button on each row. Recently-expired approvals (last 24 hours) collapse into a section below; expand to inspect.
• /dashboard/approvals/history is the archive: every approval request you have responded to, plus the ones that timed out. Filter by date, agent, or outcome.

Both pages render the same vocabulary as the alert and the cockpit. Same words mean the same thing everywhere.

Every approval request produces a record. The record names what was asked, what you decided (and how: in-product click or timeout), what the agent did with the result, and the signed receipt for the whole thing.

The record is the truth about a past approval request, frozen. If you change a rule tomorrow, the historical record still shows what the rule was at the time of the request. Audit trails do not rewrite themselves.

A record links to the receipt as a downloadable .orbitproof file and to the web verifier at /verify. See the Verifying receipts docs for how that works.

If you find yourself choosing 1H for the same kind of question every few hours, the rule is wrong for your workflow. Change it.

From the alert, open the Open-in-ORBIT link, then tap “change this rule” on the in-product card. From the in-product card directly, the same affordance is on the card. From the app, find the rule in Rules and change its verdict.

Setting a rule to Allow is the supported way to say “stop bothering me about this.” The rule still exists, the action still appears in your audit, but you stop being interrupted. Reversible at any time.

You are helping me audit recent ORBIT approvals. Read /docs/approvals first. Pull the last day of approval history, group repeated approval prompts by rule and action shape, and identify rules I keep approving manually. Do not change rules. Return suggested policy edits, the approval records you used, and which ones are time-bounded standing approvals versus one-time decisions.