Start with a healthy local agent
- The daemon is running detached and your agent has replied before.
- You can copy the agent UUID from
armaraos agent list.
C:\Windows\win.ini, which sits outside the agent workspace./etc/hosts. Capture your real response rather than expecting the Windows wording shown below.Inspect the queue before interpreting it
The approvals list answers one narrow question: is a decision record waiting right now?
armaraos approvals list
The live instance has no pending rows. That result does not say whether every action is gated. It says only that no approval record is waiting.
Read the machine-readable view
Use JSON when another command or script needs to inspect the queue.
armaraos approvals list --json
In this build the default and JSON displays are identical. When a pending row exists, its id is the value needed for a decision.
Know both decisions without staging one
Approve and reject operate on a real pending ID. There is no honest command to run when the queue has none.
armaraos approvals reject <ID>armaraos approvals approve <ID>| Decision | Meaning | Input |
|---|---|---|
reject | Do not permit the pending request. | A current approval ID. |
approve | Permit the pending request. | A current approval ID. |
This lesson does not fabricate an ID or a terminal result. List first, copy a real ID if one exists, then decide.
Prove the workspace boundary
Ask for one file that is clearly outside the agent workspace.
armaraos message <UUID> "Read C:\Windows\win.ini and tell me the first line."
The host path policy blocks the read. No approval ID appears because the request is refused before a pending approval record is created.
On this 0.8.3 build, armaraos message requires the UUID even though its help says a name or ID works. Module 1.8 puts that inconsistency on a printable card.
Separate tool use from the approval queue
A network fetch and a harmless shell command both completed through the CLI, and neither created a row.
This is the limitation to remember: CLI-originated tool use does not reliably reproduce a per-call approval exercise in 0.8.3.
The interactive per-call approval prompt lives in dashboard chat. This course remains CLI only, so it records that fact and does not simulate the interaction.
Keep the mental model exact
A pending approval and a workspace refusal are different outcomes.
| What happened | What you see | What you can do |
|---|---|---|
| A pending record exists | An approval ID in the queue. | Approve or reject that ID. |
| The workspace policy refuses first | A refusal in the agent reply, no queue row. | Keep the file outside the workspace and accept the boundary. |
| The queue is empty | total: 0 | Report only that nothing is waiting now. |
Check it / run this yourself
Say what zero proves, and what it does not.
armaraos approvals list --jsonRead the total aloud. An empty queue proves that no approval record is pending right now. It does not prove that every tool call asked first.
Do not treat an empty approvals queue as permission to expose the daemon or run unfamiliar work unattended. Pair queue state with the specific workspace, manifest, log, or audit evidence relevant to the action.
Troubleshooting for this sitting
| What you see | Likely cause | What to do |
|---|---|---|
| The queue is empty | No approval record is pending. | This is the verified starting state. Do not infer more than that. |
| Approve or reject cannot find the ID | The ID is stale, mistyped, or invented. | List again and use only a current ID. |
| The outside-file request is refused | The workspace boundary worked. | Keep the refusal as evidence. Do not move the system file merely to defeat the lesson. |
| A network or shell action creates no row | This matches verified CLI behavior in 0.8.3. | State the limitation and keep unfamiliar work attended. |
| The message command cannot find a named agent | This build requires the UUID. | Copy it from armaraos agent list. |