Your agent can't take it back. Neither can you.

What it does today

Your passkey, not your attention.

The approve flow

Captured from the real code.

1. 1

   Your agent tries it

   It sends the DELETE through Counterseal with its token. The broker checks the irreversible map and answers HTTP 428 instead of calling GitHub.

   DELETE /p/github/repos/acme/app
   Authorization: Bearer lsh_...
   
   HTTP 428
   {
     "error": "held_for_approval",
     ...
     "rule": "gh.delete",
     "map_version": "2026-10-10.1",
     "seals_needed": 1,
     "message": "Counterseal held this request because it cannot be undone: Any DELETE on GitHub removes something (repo, branch, release, key, member). Stop and ask your human to approve it at ..."
   }

   Excerpt of the real answer; ... marks what is left out.

2. 2

   It waits for you

   The app shows what was asked, which rule held it and why. Turn on alerts and your phone or computer is told.

   
3. 3

   You approve with your passkey

   One approval covers that exact request, once, within 10 minutes. Deny it, and it does not go through.

   
4. 4

   It goes on the record

   With receipts on, the hold and the approval each become a public receipt: the method and the host, never the path, body or key.

   "receipt": {
     "action": "DELETE api.github.com",
     "agent": "broker",
     "decision": "approved",
     "meta": {
       "map": "2026-10-10.1",
       "passkey": true,
       "rule": "gh.delete"
     },
     ...
   }

Captured on 20 October 2026 by running Counterseal's own code on a local machine, with a test passkey and dummy keys. The held call was never retried, so nothing reached GitHub.

Limits, said plainly

Where it stops.

• A seatbelt, not a sandbox: the hook runs on your machine and matches a map of commands. For a hard stop, give the agent a Counterseal token instead of the real key.
• The map is a reviewed list. A call it does not know is irreversible goes through; add hold rules to a token's policy for anything else you care about.
• You trust Counterseal and Cloudflare with the key: the service has to decrypt it to make the call. Start with a test key.
• Allowed GET and HEAD reads are not recorded. Writes, holds, approvals and denials are.