cayu.approvals.review

Public Cayu API. Definitions are grouped by their public source module, and definitions from private implementation modules appear on their package’s page; adding a symbol does not move existing links. The import shown at each entry is a supported public namespace. Read the Python API overview and install the required extra.

`HumanReviewCall`

from cayu.approvals import HumanReviewCall

Bases: _ReviewModel.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
`tool_call_id`	`str`	`Field(max_length=512)`
`tool_name`	`str`	`Field(max_length=512)`
`on_grant`	`Literal['eligible', 'denied', 'withheld']`	`required`

Release source · Runtime guarantees · Capability guides

`HumanReviewConflict`

from cayu.approvals import HumanReviewConflict

Bases: ValueError.

init (method)

HumanReviewConflict.__init__() -> None

Release source · Runtime guarantees · Capability guides

`HumanReviewContext`

from cayu.approvals import HumanReviewContext

Verified recipient supplied by trusted SDK code or server authentication.

Bases: _ReviewModel.

Fields and attributes

Name	Type	Default
`recipient`	`str`	`Field(min_length=1, max_length=512)`
`tenant`	`str \| None`	`Field(default=None, min_length=1, max_length=512)`
`purpose`	`str`	`Field(min_length=1, max_length=128)`

Release source · Runtime guarantees · Capability guides

`HumanReviewDenied`

from cayu.approvals import HumanReviewDenied

Bases: PermissionError.

init (method)

HumanReviewDenied.__init__() -> None

Release source · Runtime guarantees · Capability guides

`HumanReviewDisclosure`

from cayu.approvals import HumanReviewDisclosure

Bases: _ReviewModel.

Fields and attributes

Name	Type	Default
`status`	`Literal['permitted', 'redacted', 'unavailable']`	`required`
`fields`	`tuple[HumanReviewField, ...]`	`Field(default=(), max_length=32, repr=False)`
`sensitive_content`	`Literal['reject_unknown_scope', 'application_attested']`	`'reject_unknown_scope'`

Release source · Runtime guarantees · Capability guides

`HumanReviewField`

from cayu.approvals import HumanReviewField

Untrusted plain text selected by the application policy.

Bases: _ReviewModel.

Fields and attributes

Name	Type	Default
`label`	`str`	`Field(min_length=1, max_length=128)`
`text`	`str`	`Field(min_length=1, max_length=4096, repr=False)`

Release source · Runtime guarantees · Capability guides

`HumanReviewPolicy`

from cayu.approvals import HumanReviewPolicy

Application-owned authorization and narrow display projection.

version must change whenever authorization, projection or sensitivity rules change. binding_key must contain at least 32 private random bytes, be stable across workers/restarts, and never enter session storage. Losing it invalidates outstanding views. Projection must select only explicitly permitted fields. For dynamic/unknown secret scopes it must independently attest the selected output (e.g. validate against an application-owned vocabulary); redaction of currently known secrets is insufficient. Never attest arbitrary argument dumps.

Bases: ABC.

version (property)

HumanReviewPolicy.version() -> str

binding_key (property)

HumanReviewPolicy.binding_key() -> bytes

authorize (method)

HumanReviewPolicy.authorize(context: HumanReviewContext, *, session_id: str, session_metadata: Mapping[str, Any], action: Literal['inspect', 'decide']) -> bool

Deny by default; enforce session, tenant, recipient and purpose together.

project (method)

HumanReviewPolicy.project(context: HumanReviewContext, source: HumanReviewSource) -> HumanReviewDisclosure

audit (method)

HumanReviewPolicy.audit(*, action: Literal['inspect', 'decide'], status: str) -> None

Optional bounded access audit. No model text, arguments or private identities.

Release source · Runtime guarantees · Capability guides

`HumanReviewReference`

from cayu.approvals import HumanReviewReference

Opaque content binding; conveys no authority to execute or resolve.

Bases: _ReviewModel.

Fields and attributes

Name	Type	Default
`context`	`HumanReviewContext`	`required`
`policy_version`	`str`	`Field(min_length=1, max_length=128)`
`content_tag`	`str`	`Field(pattern='^[0-9a-f]{64}$', repr=False)`

Release source · Runtime guarantees · Capability guides

`HumanReviewSource`

from cayu.approvals import HumanReviewSource

Private policy input. Never log, serialize, or expose this object to a client.

Decorators: @dataclass(frozen=True).

Fields and attributes

Name	Type	Default
`kind`	`Literal['user_input', 'tool_approval']`	`required`
`interaction_id`	`str`	`required`
`tool_round_id`	`str`	`required`
`tool_call_id`	`str`	`required`
`secret_resolution_scope`	`Literal['static', 'dynamic', 'unknown']`	`required`
`calls`	`tuple[HumanReviewCall, ...]`	`required`
`arguments_by_call`	`Mapping[str, Mapping[str, Any]]`	`field(repr=False)`
`question`	`str \| None`	`field(default=None, repr=False)`
`options`	`tuple[str, ...]`	`field(default=(), repr=False)`
`expires_at`	`datetime \| None`	`None`
`executable`	`bool`	`True`

Release source · Runtime guarantees · Capability guides

`HumanReviewView`

from cayu.approvals import HumanReviewView

Protected response. All display fields are HTML-escaped untrusted text.

This response has no generic event, trace, transcript or export contract.

Bases: _ReviewModel.

Fields and attributes

Name	Type	Default
`status`	`Literal['permitted', 'redacted', 'unavailable']`	`required`
`guidance`	`Literal['Review all calls before deciding.', 'Review content is withheld; contact the application owner or deny the action.', 'No current review is available; refresh pending interactions.', 'This recovery gate cannot authorize execution; use explicit blocked recovery.']`	`required`
`session_id`	`str`	`required`
`interaction_id`	`str \| None`	`None`
`tool_round_id`	`str \| None`	`None`
`tool_call_id`	`str \| None`	`None`
`kind`	`Literal['user_input', 'tool_approval'] \| None`	`None`
`calls`	`tuple[HumanReviewCall, ...]`	`()`
`fields`	`tuple[HumanReviewField, ...]`	`Field(default=(), repr=False)`
`reference`	`HumanReviewReference \| None`	`Field(default=None, repr=False)`
`display_format`	`Literal['html_escaped_text']`	`'html_escaped_text'`

Release source · Runtime guarantees · Capability guides