The gate verb: a human authorizes or rejects an agent-originated spec. Cookie-session only by design — an agent can never authorize its own proposal.
Human-only by construction: the route never inspects the Authorization header, so agents cannot clear their own gate. Only meaningful for origin='agent' intents. Repository-authority verdicts are bound to the supplied repoBodyRevision in one transaction; any later material body revision clears the current verdict while preserving immutable history. Also stamps reviewed_at when unset (authorizing implies having seen). Agent-facing surfaces reflect the state: intents responses carry origin + authorization ('pending'/'authorized'/'rejected'; null for human-authored), the agent prompt opens with a DO-NOT-IMPLEMENT banner while pending or rejected, and intent.md frontmatter carries authorization. Emits agent_spec_authorized / agent_spec_rejected server-side.
Path parameters
id path parameter.
Request body
Response
Verdict recorded — returns { intentId, authorizationStatus, authorizedAt }