Human sign-off before an agent deploys or ships code

Let agents open PRs and run pipelines, but make the production-touching step wait for a named engineer — with a trace of who approved each release.

The problem

Coding agents are increasingly trusted to write changes, run migrations and trigger deploys. The trouble is the last step: shipping to production is where an automated mistake stops being a rollback and starts being an incident. Teams do not want to slow the agent down on everything, and reviewing every diff by hand defeats the purpose. What they need is a sign-off gate on the release itself — the agent prepares the change, a human owns the decision to ship it, and there is a record afterwards of who did.

How Raposa solves it

Raposa is a human-in-the-loop approval layer that gates the deploy without owning your pipeline. At the point the agent would ship — a deploy, a migration, a production config change — it calls request_human_approval(). Raposa pauses the agent and routes the release to a named engineer, who approves or rejects in one click. The deploy proceeds only on an explicit approval; a silence or an expiry blocks it rather than letting it slip through. Because it is one HTTP call, it drops into a CI step, an agent tool, or an n8n workflow without adopting a new framework.

For higher-risk changes you can require two signatures from a named group, add reminders and escalation, and set an audited expiry. Engineers approve from a signed email link, a Telegram card or a Slack message, so on-call can sign off from a phone without opening the runtime. Every sign-off is sealed in a hash-chained audit trail — who approved, when and why — and an HMAC-signed webhook notifies your deploy system of the outcome. Data stays in the EU with a DPA available.

What it looks like

The agent keeps its speed everywhere else; only the irreversible step waits for a person.