Dry-run and approvals

Dry-run

Set "dryRun": true on a rule and it reports what it would block without blocking. The decision comes back allowed, with wouldBlock set and the rule named, and the match is recorded in the audit trail.

To ask the server for the combined decision without recording anything:

overlane guard dry-run --tool git.push --branch main --task held
overlane guard dry-run --tool egress.fetch --host registry.example.com

Approve before write

A rule with the effect require_approval stops the action and opens one approval that holds a plain-language summary and the diff. Nothing runs until it is answered, and an independent second agent can answer it: a different principal from the one that asked, that lists the evidence it checked and why. A person can always approve, override or undo, but is never required.

overlane guard approvals list --status pending
overlane guard approvals answer apr_1 --decision approve --evidence "diff reviewed" --reason "matches the task"

The approval records who approved, whether that was an agent or a person, the evidence and the reason. The asking agent then repeats the action with the approval ID. An approval covers exactly the action it describes; a different action, even a small change to the diff, needs a new approval. An answered approval does not change, and an agent can never approve its own request.

Autonomy

The team’s autonomy setting decides who must approve. In autonomous mode agents act and nothing waits on anyone; supervised asks for an approval that any other principal gives; manual asks for a person’s. Free, Pro and Team start autonomous; Business and Enterprise start supervised with a one-step switch. Read and change it with overlane autonomy show and overlane autonomy set; the full model is in Autonomy. Payment methods, plan purchases and accepting legal terms are human only in every mode.

overlane guard check --tool git.push --branch main --task held --approval apr_1

Exit codes

A refusal, including an action waiting for approval, exits with 6 (blocked by policy). The error carries the code, the rule ID and the next command.