Approvals API — not a real concept in this API

There is no /approvals route family in the Hoziron HTTP API: no GET /approvals, POST /approvals/{id}/approve, or POST /approvals/{id}/reject anywhere in crates/surfaces/hoziron-api/src/routes.rs (v1_routes()), no ApprovalRead/ApprovalDecide variant in the Action permission enum (hoziron-core-types/src/auth/permissions.rs), and no list_approvals/approve/reject method anywhere in hoziron-core. There is no human-in-the-loop approval queue in this codebase.

If you need a sign-off gate before an action executes, the two real mechanisms available are:

1. Agent lifecycle gating (ADR-056)

hoziron-cli agent activate (and catalog install --activate) is gate-checked: activation fails if any contract the agent declares has no installed integration bound to it. This blocks an agent from running until its dependencies are satisfied, but it is a structural precondition check, not a human-approval step — see agent.md.

2. RBAC-scoped mutating routes

Any route that changes platform state is already gated by role (admin, operator, etc. — see security.md). If the goal is "only a privileged operator can trigger X," a scoped API key issued via POST /auth/keys (see auth.md) is the actual mechanism, not a queued approval a second person later signs off on.