0040: Approvals on the better-supabase approvals block

Approval requests, decisions and policies move onto the approvals block over CentraKit's own tables once better-supabase lets app code file a request under its own policy, name the requester as the service role and pass a step's approvers to out-of-office covers.

Status: Proposed
Date: 2026-10-29
Supersedes: ADR 0037, item 2

Context

ADR 0037 kept approvals on CentraKit storage because the approvals block compiled static policies and read the latest status. better-supabase 0.36 to 0.41 closed those items: tenant policies in a table, platform policies without an organization, conditions matched against the request payload, policies by effect and for every action, confirm and authorize modes, steps with a quorum, every holder of a permission, a manager or named users, escalation, expiry, consume-once against a fingerprint, requests without an organization, decidedBy for the service role, and requests and decisions mapped over the app's own tables.

A check of 0.41.0 against CentraKit found three flows the block cannot carry yet:

Workflow approval nodes, the approval policy on workflow action nodes and the confirm fallback for a requester nobody else can approve all file a request under a policy the app builds. The block only files under the configured and stored policies.
Out-of-office covers. PermDock's isApprover checks a cover against the approvers configured per request kind, not against the current step's approvers, so a cover of a manager or of a user named in a policy is lost.
Requests the service role files have no requester, so the person behind a workflow could approve an authorize request their own workflow raised.

Requests, decisions and policies share one set of tables and one inbox, so they move together or not at all.

Decision

Approvals move onto the approvals block in one change once the library covers those three flows. Until then they stay on CentraKit storage as ADR 0037 describes. The move maps the block as follows:

tables.requests, tables.decisions and tables.policies map over approval_requests, approval_decisions and approval_policies, with tenantPolicies, platformPolicies, conditions: "payload" and tenantless for personal AI chats. The block's statuses replace CentraKit's, and the contracts keep their own names (requested, denied, canceled, consumed) so the API does not change.
The block's requirement replaces the policy evaluation in TypeScript and PermDock's approval-required decision for gated actions. PermDock keeps deciding permissions and owns out-of-office covers through rls.approvals.delegations and the provider's isApprover, which replaces approval_delegations.
Floors are generated from the action catalog with each action's effects, one per subject type that files requests. Organization and platform policies use subject type *, an actor kind becomes a payload condition, and any, all and sequential approvers become steps.
Leave, expenses and timesheets keep approvals: false in their blocks, since the block does not support per-employee timesheets, standalone expenses or a manager step for the request's employee. CentraKit files their requests on the block and applies the final decision with decidedBy.

Consequences

Leave and expenses decided through the service role already record the decider through decidedBy.
Until the move, approval policies, requests, delegations and their SQL stay as ADR 0037 describes.
A better-supabase and PermDock release that covers the three flows above is the trigger to make the move. Floors with dotted action names and for every subject type, switchable approval notifications, covers without a PermDock request store and extra columns on policies would remove generated floors and lost policy descriptions, but do not block it.

Last updated on

0040: Approvals on the better-supabase approvals block

Status: Proposed
Date: 2026-10-29
Supersedes: ADR 0037, item 2

Context

A check of 0.41.0 against CentraKit found three flows the block cannot carry yet:

Workflow approval nodes, the approval policy on workflow action nodes and the confirm fallback for a requester nobody else can approve all file a request under a policy the app builds. The block only files under the configured and stored policies.
Out-of-office covers. PermDock's isApprover checks a cover against the approvers configured per request kind, not against the current step's approvers, so a cover of a manager or of a user named in a policy is lost.
Requests the service role files have no requester, so the person behind a workflow could approve an authorize request their own workflow raised.

Requests, decisions and policies share one set of tables and one inbox, so they move together or not at all.

Decision

Approvals move onto the approvals block in one change once the library covers those three flows. Until then they stay on CentraKit storage as ADR 0037 describes. The move maps the block as follows:

tables.requests, tables.decisions and tables.policies map over approval_requests, approval_decisions and approval_policies, with tenantPolicies, platformPolicies, conditions: "payload" and tenantless for personal AI chats. The block's statuses replace CentraKit's, and the contracts keep their own names (requested, denied, canceled, consumed) so the API does not change.
The block's requirement replaces the policy evaluation in TypeScript and PermDock's approval-required decision for gated actions. PermDock keeps deciding permissions and owns out-of-office covers through rls.approvals.delegations and the provider's isApprover, which replaces approval_delegations.
Floors are generated from the action catalog with each action's effects, one per subject type that files requests. Organization and platform policies use subject type *, an actor kind becomes a payload condition, and any, all and sequential approvers become steps.
Leave, expenses and timesheets keep approvals: false in their blocks, since the block does not support per-employee timesheets, standalone expenses or a manager step for the request's employee. CentraKit files their requests on the block and applies the final decision with decidedBy.

Consequences

Leave and expenses decided through the service role already record the decider through decidedBy.
Until the move, approval policies, requests, delegations and their SQL stay as ADR 0037 describes.
A better-supabase and PermDock release that covers the three flows above is the trigger to make the move. Floors with dotted action names and for every subject type, switchable approval notifications, covers without a PermDock request store and extra columns on policies would remove generated floors and lost policy descriptions, but do not block it.

Last updated on

0040: Approvals on the better-supabase approvals block

Context

Decision

Consequences

On this page

0040: Approvals on the better-supabase approvals block

Context

Decision

Consequences

On this page

0040: Approvals on the better-supabase approvals block

ContextCopy Anchor Link

DecisionCopy Anchor Link

ConsequencesCopy Anchor Link

On this page

0040: Approvals on the better-supabase approvals block

ContextCopy Anchor Link

DecisionCopy Anchor Link

ConsequencesCopy Anchor Link

On this page

Context

Decision

Consequences

Context

Decision

Consequences