← All guides · Reviewed November 2026
Who Approved That Agent Action?
The short answer
The receipt names them. Every Agentic Receipt carries an approver — a user id or email — plus the agent's name, version and operator, the amount and the declared scope, sealed with its timestamp into the hash-chained ledger. Where one approver is not enough, the platform adds patterns on top: email request-and-approve, two-person quorum at an amount threshold, and counterparty co-sign — each decision recorded as its own chained event. Approval flows as implemented in Agentic Receipts, November 2026. See the record shape in What Is an Agent Receipt?
Which approval patterns exist?
| Pattern | Who approves | What is recorded | Plan |
|---|---|---|---|
| Direct issue | The owner, at the desk | The receipt itself, naming the approver, sealed at issue | Free and up |
| Email request-and-approve | Named approvers, by link | One signed link per approver (only its SHA-256 hash stored, 7-day expiry, decided links cannot replay); the receipt issues when the required decisions arrive | Pro |
| Quorum | A rule's approver list, count required | At or above the owner's amount threshold, the rule's approvers and approvals-needed take over — two-person quorum in the standard configuration | Team |
| Counterparty co-sign | The other party to the deal | The co-signature as a chained event on the receipt (invite links valid 30 days) | Pro |
| Revoke and replace | The owner | A revocation event plus a replacement receipt linked to its parent — history is appended, never edited | Pro |
Why does the pattern matter?
Because "someone approved it" fails in predictable places. A direct issue is right for the owner-operator who is the approver. It fails when the approver is someone else — a manager, a client, a finance lead — who never touched the platform: the email request puts the decision in their hands, under their name, before the action, with a link that expires and cannot be reused. It fails again at size: above real money, one person's yes is not a control, which is what the quorum threshold is for. And it fails across the table: when the dispute is with the counterparty, their co-signature on the same receipt — not a screenshot of a chat — is the artefact that answers. Each pattern answers the title question with a name, a time and a seal; the ledger mechanics are in Hash-Chained Ledgers, Explained.
What does the full trail look like over a receipt's life?
Issue (or approval-request decisions) → optional co-sign → use confirmations that draw down the remaining balance → expiry notices at 7 days and 1 day before the authorization lapses → renewal as a replacement receipt, or revocation. Every step is an event in the same per-owner chain, in order, each pointing at the receipt it belongs to. Nothing is overwritten; a revoked receipt still shows that it was issued, used and revoked — which is what an auditor, a bank disputes clerk or a court would ask to see.
Frequently asked questions
Who approved that agent action?
The receipt itself answers: every Agentic Receipt names its approver — a user id or email — alongside the agent's name, version and operator, the action, the amount and the declared scope, sealed with a timestamp into the hash-chained ledger. If the approval came through a flow (an email request, a quorum, a co-sign), the deciding events are chained entries on the same receipt, each with its own approver identity.
What is email request-and-approve?
The owner drafts the authorization and sends approval links to named approvers. Each link is a signed token; only the token's SHA-256 hash is stored, links expire after 7 days, and a link that has been decided cannot be replayed. When the required decisions arrive, the receipt issues with the request's fields — the approval happened before the action, by named people, on the record.
What is a two-person quorum approval?
A Team-plan rule: at or above an amount threshold the owner sets, the rule's approver list and approval count take over — the receipt cannot issue until the required number of named approvers (two-person quorum in the standard configuration) have each decided through their own links. Below the threshold, the normal single-approval path applies.
What does a counterparty co-sign add?
A second party's signature on the same receipt: the counterparty receives a co-sign invite (links valid 30 days) and their signature is recorded as a chained event on the receipt. The receipt then shows both sides — the operator who authorized and the counterparty who countersigned — which is the shape a payment dispute actually asks for.
What happens if an approval needs to be withdrawn?
Receipts are revoked and replaced, never edited: the revocation is a new chained event, and a replacement receipt links back to its parent. The ledger keeps the whole story — issue, co-sign, use confirmations against the remaining balance, expiry notices at 7 days and 1 day, revocation — in the order it happened.