Approve one AI agent action—not an entire unattended session.
Review exact coding-agent actions remotely with signed policy context, bounded expiry, and crash-safe one-time consumption.
The problem
A generic “allow” button is too broad for unattended work. The same label can hide a different command, path, patch, environment, or network target by the time a provider retries it.
The operating model
Sleep Mode binds an approval to the exact action digest, active run, agent, provider callback, workspace, capability, response level, and deadline.
From vague autonomy to bounded operations.
Request inside the ceiling
An agent can ask for an action already permitted by the signed run policy. It cannot elevate the policy.
Review the canonical action
The operator sees the normalized command or content-hash-bound edit rather than a vague permission category.
Consume exactly once
The device records a permanent local release marker immediately before returning the provider allow response.
Deny ambiguity
Network, session-wide, outside-workspace, protected-path, background, or patch-opaque requests fail closed.