TICKETIQ

Segregation of duties on approvals

Segregation of duties — who may approve. A person who approves an agent's held write must hold that right themselves; each decision records whether they did, and enforce mode refuses one who did not.

After reading this page you will be able to:
  • See whether each approval's approver held the right to the action
  • Turn on enforcement of approver entitlement
  • Read the audit and ledger records of a missing entitlement

Letting an agent's held write go ahead lends the agent the decider's authority for that one call. So the person deciding should hold that authority: someone who could not post to the ERP should not be able to make an agent do it with one click.

What is checked

When a person decides a held MCP call, Liyagent asks whether that person could make the same call themselves, the way the console decides a person's own tool call:

  1. Cedar read on the MCP server, as that person, with their role;
  2. Cedar call_tool on the tool (Tool::"server/tool"), as that person;
  3. for a tool that can write, the permissions the agent requires of a person it acts for (require_invoker_permissions in the agent's runtime, tickets.write by default).

The check runs in approvals.approve, so it applies to every door a decision comes through: the console, batch decisions, the mobile app, the liya CLI and Teams cards. Pipeline proposals and framework releases are not MCP calls and keep their own checks.

Modes

TICKETIQ_APPROVAL_ENTITLEMENT (default audit):

ModeWhat happens
audit (default)The answer is recorded on the decision (entitlement on the approval record) and on its trust-ledger receipt. A missing entitlement writes agent.approval.entitlement.missing. The decision still goes ahead, so no flow that works today gains a new blocker.
enforceA decider without the entitlement is refused with 403. The request stays pending for someone who holds the right, the refusal is audited, and a decision receipt with status refused_approver is written.
offNo check.

Start with audit, read the agent.approval.entitlement.missing rows to see who would be refused, give them the permissions or move those decisions to people who hold them, then switch to enforce.