Approvals & safety

From ask to card

When an engine wants to do something your permission mode does not cover, it raises an ask and blocks. Ka’s asks have no timeout: an unanswered ask would wedge the session forever. ka agent owns expiry instead:

• Every ask becomes an approval card with an id, the exact subject, and a TTL (approval_ttl_secs, default 900s).
• On Telegram the card renders as a message with Allow / Deny inline buttons; on the console as a prompt answered with /y or /n.
• If the TTL lapses with no decision, ka agent answers deny, records the expiry in the audit log, and the turn continues.

Fail closed is the rule: silence can never authorize. abort during an ask is always allowed and cancels the cycle.

What is never offered

• “Always allow” from remote channels. Ka’s “always” is a coarse per-tool-name allow written into the project .ka/ka.toml; a chat button is the wrong place for that. Durable grants live in ka agent’s own rules layer, where you can list and revoke them.
• Local-only commands from channels. shell, set_feature, set_sandbox, save_api_key, save_settings cannot be reached from a channel at all; the port has no operation that maps to them.

The audit chain

Every decision (allow, deny, expiry) and every notable event lands in an append-only audit chain in the state store. Unauthorized channel traffic is audited too, and gets no reply.

Budgets

Two daily caps, configured in ka-agent.toml:

[budgets]
daily_usd = 5.0            # ka usage accounting, enforced via the engine spend guard
daily_tokens = 2_000_000   # the only cap that binds for unpriced models

Spend is reported per turn (the console prints turn done · $0.0137 · 6,205 tokens), and the spend guard raises an ask that becomes an approval card like any other.

Kill semantics

/stop aborts the running cycle and waits the grace period (default 10s). If the worker does not settle, ka agent SIGTERMs the worker’s process group (so tool children die too; the engine layer forces bash jobs to never detach), then SIGKILLs after a further 5s. The turn is marked aborted or killed, and never replayed automatically.