Skip to main content

Write approvals

Kenaz, a Kameas AI product.

Some of the plugin's tools write to Kameas Fleet on your behalf. Kenaz never lets your agent make those writes on its own say-so: you approve each one yourself, in your browser, with a security key or your device's unlock.

What needs approval​

  • Publishing a skill (skills_publish), and sharing or promoting team context (context_share, context_promote, and the /kenaz:share command).
  • Memory changes for your signed-in account that reach Kameas Fleet: deleting all your notes, turning on memory sync, sending changes that wait for approval, moving notebook notes into your account, and saving, editing or deleting a note while sync is on (or a note Kameas Fleet already holds).

When your agent, or a kenaz memory command, asks for one of these, nothing is written yet. Kenaz prepares a request and returns a request_id, status: "pending" and an approve_url. Nothing is uploaded until you open that link, check the exact content and destination shown there, and approve.

Why approvals exist​

Your agent can ask for a write, but it can't approve one. A permission prompt in Claude Code or Codex, an "always allow" setting, or a user_confirmed argument from the agent doesn't count as approval. Neither the kenaz command nor any tool can approve, cancel or set up a key: those happen only on the approval page.

Set up a security key or passkey​

Do this once per device:

kenaz approvals enroll

This opens the approval page's setup screen at http://localhost:<port>/approvals/enroll.

  1. Choose Set up an authenticator.
  2. Sign in to Kameas Fleet again in the browser. Only the account you signed in with using kenaz login is accepted, and setup continues only in the browser that completed that sign-in.
  3. Finish with your security key, or your device's unlock (Touch ID, Windows Hello or a PIN), which uses WebAuthn with user verification.

To add another key, choose Add another authenticator; a key you already set up has to approve it. If you lost every key, choose Replace lost authenticators: it signs you in again and revokes the old keys and any open requests.

Only complete a Kameas Fleet sign-in for setup that you started yourself.

Approve a request​

  1. Open the link your agent shows, or run kenaz approvals to list requests and kenaz approvals open <request_id> to open one.
  2. Check the content and destination on the page. The page's text is written by the kenaz relay from the exact stored request, not by your agent. For memory notes, use Show full text to read a whole note.
  3. Choose Approve with security key or device unlock, or Cancel.
kenaz approvals [list | status <request_id> | open [request_id] | enroll] [--no-browser] [--env E]

--no-browser prints the page link instead of opening it. Your agent can check a request with the approval_status tool.

The page is served by the local kenaz relay at http://localhost:<port>/approvals/. Paste the link into your browser's address bar. A link you follow from a web page, chat or email is refused on purpose; the page then says "Kenaz approvals: this page was not opened." and repeats the link for you to copy.

Expiry and interruptions​

  • A request expires 5 minutes after your agent prepares it. If it expires, ask your agent to prepare it again.
  • kenaz logout, or switching accounts, cancels open requests and deletes their content.
  • If the relay stops in the middle of a write, the request shows reconciling. Kenaz then checks whether the write arrived and never sends it again blindly. Signing out closes a reconciling request as outcome_unknown; a request still reconciling after 7 days is closed as failed (outcome_unknown).

Many notes at once​

One approval lists at most 64 memory notes, each with its full text. With more, the command approves the first 64 and says how many remain; run it again after approving to review the next batch.

When approval isn't available​

If no key is set up and none can be, the write tools return approval_unavailable and nothing is written. This also happens:

  • when kenaz keeps your sign-in in files because there's no OS keychain (credential store: files in kenaz status): approvals are always unavailable there;
  • with builds you compile yourself from the public source, which can't connect to Kameas Fleet.

Which browsers, operating systems and authenticators work hasn't been tested yet.

What approvals don't protect against​

Approvals protect against an agent that acts only through the kenaz tools and commands. They don't contain an agent that can run arbitrary shell commands as your OS user: such an agent can reach anything your user account can, including your Kameas Fleet sign-in. Kenaz accepts any authenticator that reports user verification and doesn't require attestation, so it can't tell a hardware key from a software one.

Claude and Claude Code are trademarks of Anthropic, PBC. OpenAI and Codex are trademarks of OpenAI. Kenaz and Kameas are trademarks of Kameas AI, Inc. Kenaz for Claude Code and Codex is an independent product of Kameas AI, Inc. and is not affiliated with, endorsed or sponsored by Anthropic or OpenAI.