The gate verb: a human authorizes or rejects an agent-originated spec. Cookie-session only by design — an agent can never authorize its own proposal.
Human-only by construction: the route never inspects the Authorization header, so agents cannot clear their own gate. Only meaningful for origin='agent' intents. Also stamps reviewed_at when unset (authorizing implies having seen). A verdict can be changed by issuing the other verb; the latest human call stands. Agent-facing surfaces reflect the state: intents responses carry origin + authorization ('pending'/'authorized'/'rejected'; null for human-authored), the agent prompt opens with a DO-NOT-IMPLEMENT banner while pending or rejected, intent.md frontmatter carries authorization, and the create response includes a notice instructing the agent to wait. Emits agent_spec_authorized / agent_spec_rejected server-side.
Path parameters
id path parameter.
Request body
Response
Verdict recorded — returns { intentId, authorizationStatus, authorizedAt }