Guide

Control Write Safety

Gate dangerous operations with human approval policies.

Write operations like merging a PR or closing an issue can have irreversible consequences. The SDK provides an approval layer that intercepts mutations before they execute.

Configure write safety and approvals

Require approval for all writes

By default, every write operation requires explicit approval. You don't need to pass any extra option:

default-approval.ts

import { createGithubTools } from '@github-tools/sdk'

const tools = createGithubTools()

Disable approval in trusted environments

In CI pipelines or automated workflows where human review happens elsewhere (e.g. PR-based), you can disable approval entirely:

ci-pipeline.ts

import { createGithubTools } from '@github-tools/sdk'

const tools = createGithubTools({
  requireApproval: false,
})

Configure approval per operation

For nuanced policies, enable approval selectively. This example approves destructive actions but allows comments freely:

selective-approval.ts

import { createGithubTools } from '@github-tools/sdk'

const tools = createGithubTools({
  requireApproval: {
    createBranch: false,
    forkRepository: true,
    createRepository: true,
    mergePullRequest: true,
    createOrUpdateFile: true,
    closeIssue: true,
    createPullRequest: false,
    addPullRequestComment: false,
    createIssue: false,
    addIssueComment: false,
  },
})

Assess risk by operation

Operation	Risk	Suggested policy
`createRepository`	High	Always require approval
`forkRepository`	High	Always require approval
`createOrUpdateFile`	High	Always require approval
`mergePullRequest`	High	Always require approval
`closeIssue`	Medium	Require in production repos
`updateIssue`	Medium	Require in production repos
`createPullRequest`	Medium	Optional in trusted CI
`updatePullRequest`	Medium	Require in production repos
`createBranch`	Low	Usually skip
`deleteBranch`	High	Always require approval
`addPullRequestComment`	Low	Usually skip
`updatePullRequestComment`	Low	Usually skip
`deletePullRequestComment`	Medium	Require in production repos
`createPullRequestReview`	Medium	Require in production repos
`replyToReviewComment`	Low	Usually skip
`resolveReviewThread`	Low	Usually skip
`requestReviewers`	Low	Usually skip
`addIssueComment`	Low	Usually skip
`updateIssueComment`	Low	Usually skip
`deleteIssueComment`	Medium	Require in production repos
`addLabels`	Low	Usually skip
`removeLabel`	Low	Usually skip
`createLabel`	Medium	Confirm
`updateLabel`	Medium	Confirm
`deleteLabel`	High	Always confirm
`addAssignees`	Low	Usually skip
`removeAssignees`	Low	Usually skip
`addIssueReaction`	Low	Usually skip
`addCommentReaction`	Low	Usually skip
`addDiscussionComment`	Low	Usually skip
`markNotificationRead`	Low	Usually skip
`deleteGist`	High	Always require approval
`createGist`	Medium	Optional in trusted CI
`updateGist`	Medium	Require in production
`createGistComment`	Low	Usually skip
`triggerWorkflow`	High	Always require approval
`cancelWorkflowRun`	High	Always require approval
`rerunWorkflowRun`	Medium	Require in production repos
`createRelease`	High	Always require approval
`updateRelease`	Medium	Require in production repos
`deleteRelease`	High	Always require approval

Override approval per tool

You can also set needsApproval via the overrides option, which supports all AI SDK tool properties:

override-approval.ts

createGithubTools({
  overrides: {
    addIssueComment: { needsApproval: false },
    mergePullRequest: { needsApproval: true },
  },
})

When both requireApproval and overrides set needsApproval for the same tool, the overrides value wins (it is applied last).

eve approval (richer policies)

On the eve extension (recommended) or the deprecated direct /eve import, requireApproval supports boolean gates, 'once' (approve once per session), string sugar ('always' / 'never'), input-dependent predicates, and passthrough of eve's always() / once() / never() helpers. Write tools default to always() when unlisted.

agent/extensions/github.ts

import githubExtension from '@github-tools/eve-extension'

export default githubExtension({
  preset: 'maintainer',
  requireApproval: {
    mergePullRequest: true,
    createIssue: 'once',
    createOrUpdateFile: ({ toolInput }) => toolInput?.owner !== 'vercel-labs',
  },
})

Unlike createDurableGithubAgent, eve approval pauses the session durably until a person approves.

Approval is one safety layer, not the only one. Combine it with least-privilege token scopes and narrow presets.

External references

GitHub branch protection rules

Edit this pageorReport an issue

Scope with Presets

Expose only the tools your workflow needs using presets.

Commit Attribution

Configure author, committer, and co-authorship for commits created by GitHub tools.