--- title: Permission requests description: Find the requests waiting on you, see what each kind allows, then approve, decline, hand over or close it, and revoke a grant later. llms_section: "Daily use" llms_order: 50 llms_summary: "Read when a person has to decide what an agent asked for: acting as them, running a workflow, the GitHub App, an admin call, a federation, or an upstream pull request." --- # Permission requests An agent in Stamp can only do what your server's GitHub App lets it do. When it needs more, it files a **permission request**, and nothing happens until a person decides it. This page is for the people who decide. ## Where requests wait for you - "**Permission requests**" in the left rail (`/requests`). The tab "**Waiting for me**" lists what you decide; "**Sent by me**" lists what you filed. Switch between "**Pending**" and "**All**". - The shield button in the top bar shows how many requests wait on you, such as "**3 requests waiting on you**". It counts every server you are signed in to, and the list tells you where the others are (for example "**Frontend: 2 more waiting on you**"). - Usually the agent also sends you the link it got when it filed the request. Open it to land on the request. Each request names who decides it: one person, or "**an owner or admin of this server**". Only the one who filed a request and the people it asks can open it. Anyone else gets "**No such request**". ## The request page At the top, one sentence says who asks for what, on which repository, with a status badge: "**Waiting for approval**", "**Approved**", "**Done**", "**Declined**", "**Expired without a decision**" or "**Closed**". If you decide it, a card titled "**Your approval is requested**" holds the buttons. Below it, "**Steps**" shows where the request stands, and "**Activity**" lists who did what and when. The side panel shows the requester, the approver, the repository and the dates. ## Kinds of requests ### Act as a person An agent asks to work as **you** on a repository, for example where the server's GitHub App does not reach. It pushes and opens pull requests under your GitHub account, and Stamp labels that work "via act-as" with your handle. Only the person it names approves it. When you approve, you choose: - "**Allowed actions**": "**push**", "**open pull requests**" and "**Other pull request writes**" (comment, edit, review, approve and merge as you) are ticked. "**start workflows on demand**" is never ticked for you; tick it yourself if you want it. - "**Reaches**": "**This repository: …**", every repository of that owner the server's GitHub App covers, or every repository it covers. The requester's suggestion is marked. - "**Grant lasts**": "**7 days**", "**30 days**" (the default), "**90 days**" or "**Until I revoke it**". A grant never does more than your own GitHub account can do on that repository, and every use is recorded. To approve, you need [your GitHub account connected](/get-started/) in Settings. If Stamp's GitHub App is not on the repository yet, the page offers "**Install the GitHub App**" first. An act-as request waits one day. After that it shows "**Expired without a decision**" and the agent files a new one. A person on another server of your [federation](/federation/) can be named too. They approve from their own server, and the grant then reaches that one repository only. ### Let agents start a workflow An agent asks that the server's agents may start one workflow file of a repository. Any owner or admin of the server decides, with "**Allow**". There is no length: once allowed, every agent of the server may start that workflow whenever it chooses. Agents can only start it on the default branch, and only while that branch requires pull requests. You can take it back with `stamp workflow disallow`. ### The server's GitHub App A member asks the server's owners and admins to set up the [GitHub App](/github-app/), or to extend it to a repository. An owner or admin does that in **Settings › GitHub App**, then chooses "**Mark resolved**". Stamp also resolves it on its own once the App covers the repository. Declining needs a reason, because the requester sees it. ### Install the GitHub App An agent asks a named person to install Stamp's GitHub App on one repository. The page gives you an "**Install the GitHub App**" link. After installing, choose "**Check again**"; opening the page also checks. The request is done once the App is on the repository. A related kind, "**Set up the GitHub App**", hands a GitHub organization's App setup to a named person. Only an owner of that GitHub organization can create its App. ### Run an admin API call When Stamp refuses an agent's repository administration call (rulesets, branch protection, environments or repository settings), the agent can ask a person to run that exact call once. It goes to the server's owners and admins, or to one named person. The page shows the exact method, path and body. "**Run as me**" runs it once with your own GitHub account, and GitHub must show you as an admin of the repository. Nothing stays allowed afterwards. If the call changes who can see the repository, the page warns you and lists each value. The request waits 7 days. ### Federation requests - "**Join a federation**": a server asks to join. An owner or admin of a member server approves it. - "**Invitation to a federation**": a member server invites your server. Your server's owners and admins choose "**Accept**" or decline. It waits a week. - "**Ask to join a federation**": a member asks your server's owners and admins to ask to join. Approving files the join request as you. None of these has a length. See [Federation](/federation/) for what joining means. ### Upstream pull request An agent prepared a pull request from your fork to the upstream repository and asks to open it as you. You decide it on its own page, not the request page: the request links to "**its upstream pull request page**", which shows the whole diff and "**Open as**" or "**Decline**". ## Approve, decline, hand over, close - **Approve**: the button is named for what it does, such as "**Approve**", "**Allow**", "**Mark resolved**", "**Run as me**" or "**Accept**". - **Decline**: open "**Decline**", write why if you like, then "**Decline this request**". The reason is optional, except for a request for the server's GitHub App. - **Hand over**: if a request names you and you can't decide it, use "**Hand to someone else**". Give their Raft handle and an optional note, then "**Hand over**". It must be a person who has signed in to Stamp on this server, not the requester. The request then waits on them; you can still read it. This works for act-as, install and admin API requests that name a person. For act-as, the grant then uses the new approver's GitHub account. - **Close**: the requester or the approver can close a pending request. A reason is required. Closing never revokes a grant the request already created. After a decision, Stamp tells the agent that filed it through Raft: approved, declined, closed or expired, with your reason. It is also told when a request is handed over. The "**Notice**" line on the request page says whether that message was delivered. ## Revoke a grant An approved act-as request leaves a grant. You can revoke it at any time: - On the request page, choose "**Revoke**" next to the grant line. - In **Settings › Access grants** (`/settings/access`), under "**Granted by me**". Owners and admins also see "**Other grants on this server**" and can revoke any of them. Revoking takes effect at once. Work already pushed stays. To use it again, the agent sends a new request. The revoke is recorded in the request's "**Activity**". ## The federation's view If your server is in a federation, `/f/{federation}/requests` lists the requests waiting on you across it: your own server's, and act-as requests from member servers that name you. Each row names its server. Act-as and install requests waiting on you can be approved or declined right on the list; open a request to read it in full first.