Required fields
Request
id, protocol_version, work_session_id, requester_actor_id, requester_worker_id, target_human_worker_id, policy_decision_id, type, blocking_scope, reason_code, reason_summary, requested_action, requested_outcome, risk_class, human_decision_needed, options, default_if_no_response, status, created_at, and expires_at
Review
id, work_session_id, reviewer_actor_id, reviewer_worker_id, target_ref, decision, and created_at
Takeover
id, work_session_id, requested_by_actor_id, controlling_actor_id, affected_scope, reason, lock_epoch, state, and created_at
ApprovalScope
request_id, review_id, policy_decision_id, request_revision, request_event_hash, normalized_action_hash, approved_action, allowed_scope, denied_scope, expires_at, max_uses, applies_to_work_session_id, and applies_to_actor_id
Request rules
- Request is created when AgentWorker needs HumanWorker permission, context, judgment, review, correction, or takeover before safely continuing a specific scope.
- Request blocks only its declared
blocking_scope unless the scope is the full WorkSession.
- Request records
policy_decision_id, risk, options, selected outcome, expiry, and safe fallback.
- Request is not chat, notification, or authority.
- The protocol rejects unresolved Request when the blocked scope continues.
Request lifecycle
pending
Request exists and blocks its declared scope.
acknowledged
HumanWorker has seen the Request without resolving it.
approved, denied, narrowed, answered
Review records human judgment and resolves the Request outcome.
needs_revision
HumanWorker requires the AgentWorker to revise the plan, request, artifact, or output.
takeover
HumanWorker assumes direct control through Takeover.
expired, cancelled, superseded
The safe fallback, cancellation, or replacement rule resolves the Request state.
Request resolver refs
resolved_by_review_id is required when Request status is approved, denied, narrowed, answered, or needs_revision.resolved_by_takeover_id is required when Request status is takeover.closed_by_event_ref is required when Request status is expired, cancelled, or superseded.superseded_by_request_id is required when Request status is superseded.- The protocol rejects missing resolver refs with
missing_review_resolution, missing_takeover_resolution, missing_jarvis_event, or missing_superseding_request.
Review and ApprovalScope
Review records human judgment. ApprovalScope is required when Review approves or narrows a Request.
Review decisions
approve, deny, narrow, answer, correct, takeover, needs_revision
ApprovalScope binds
request_id, review_id, policy_decision_id, request_revision, request_event_hash, normalized_action_hash, approved_action, allowed_scope, denied_scope, expires_at, max_uses, applies_to_work_session_id, and applies_to_actor_id
Takeover rules
- Takeover records direct human control over the affected scope.
- Takeover states are
requested, locked, human_active, reconciliation_required, resumed, and closed.
- Takeover uses
lock_epoch to reject stale autonomous continuation.
- Resumed Takeover requires
reconciliation_refs, resumed_by_actor_id, and resolved_at.
- The protocol rejects stale Takeover continuation and missing Takeover reconciliation.
Allowed transitions are requested -> locked, requested -> closed, locked -> human_active, locked -> reconciliation_required, locked -> closed, human_active -> reconciliation_required, human_active -> closed, reconciliation_required -> resumed, reconciliation_required -> closed, and resumed -> closed.