Skip to main content

Class: StepUpAuthorizationManager

Defined in: security/StepUpAuthorizationManager.ts:93

Step-Up Authorization Manager.

Provides tiered authorization for tool execution with:

  • Global default risk tiers
  • Per-tenant overrides
  • Dynamic escalation triggers
  • Contextual overrides for trusted sessions
  • HITL integration for high-risk actions

Example​

const authManager = new StepUpAuthorizationManager(
  DEFAULT_STEP_UP_AUTH_CONFIG,
  async (request) => {
    // Send to UI/Slack for approval
    return await hitlManager.requestApproval(request);
  }
);

// Register tenant overrides
authManager.setTenantOverrides({
  tenantId: 'acme-corp',
  toolOverrides: new Map([['delete-all', ToolRiskTier.TIER_3_SYNC_HITL]]),
  categoryOverrides: new Map([['system', ToolRiskTier.TIER_3_SYNC_HITL]]),
});

// Authorize a tool call
const result = await authManager.authorize({
  tool: { id: 'send-email', displayName: 'Send Email', category: 'communication', hasSideEffects: true },
  args: { to: '[email protected]', subject: 'Hello' },
  context: { userId: 'user-1', tenantId: 'acme-corp' },
});

if (result.authorized) {
  // Execute the tool
}

Constructors​

Constructor​

new StepUpAuthorizationManager(config?, hitlCallback?): StepUpAuthorizationManager

Defined in: security/StepUpAuthorizationManager.ts:116

Parameters​

config?​

Partial<StepUpAuthorizationConfig> = {}

hitlCallback?​

HITLRequestCallback

Returns​

StepUpAuthorizationManager

Methods​

authorize()​

authorize(request): Promise<AuthorizationResult>

Defined in: security/StepUpAuthorizationManager.ts:135

Authorizes a tool execution request.

When autoApproveAll is enabled in the config, all requests are immediately authorized as Tier 1 (autonomous) with no further checks. This covers skill tools, side-effect tools, capability-requiring tools, destructive commands, build commands, and every other tool type.

Parameters​

request​

ToolCallRequest

Returns​

Promise<AuthorizationResult>

clearReviewedItems()​

clearReviewedItems(): number

Defined in: security/StepUpAuthorizationManager.ts:679

Clears reviewed items from the queue.

Returns​

number

getAsyncReviewQueue()​

getAsyncReviewQueue(): readonly AsyncReviewItem[]

Defined in: security/StepUpAuthorizationManager.ts:643

Gets the async review queue.

Returns​

readonly AsyncReviewItem[]

getConfig()​

getConfig(): StepUpAuthorizationConfig

Defined in: security/StepUpAuthorizationManager.ts:721

Gets the current configuration.

Returns​

StepUpAuthorizationConfig

getPendingReviews()​

getPendingReviews(): AsyncReviewItem[]

Defined in: security/StepUpAuthorizationManager.ts:650

Gets pending review items.

Returns​

AsyncReviewItem[]

getRiskTier()​

getRiskTier(request): ToolRiskTier

Defined in: security/StepUpAuthorizationManager.ts:176

Returns the effective risk tier for a request without performing authorization side effects (no stats, no async-review queue, no HITL).

Useful for filtering tool exposure in headless/server modes.

Parameters​

request​

ToolCallRequest

Returns​

ToolRiskTier

getStatistics()​

getStatistics(): AuthorizationStatistics

Defined in: security/StepUpAuthorizationManager.ts:693

Gets authorization statistics.

Returns​

AuthorizationStatistics

getTenantOverrides()​

getTenantOverrides(tenantId): TenantRiskOverrides | undefined

Defined in: security/StepUpAuthorizationManager.ts:636

Gets tenant overrides.

Parameters​

tenantId​

string

Returns​

TenantRiskOverrides | undefined

markReviewed()​

markReviewed(itemId, decision): boolean

Defined in: security/StepUpAuthorizationManager.ts:657

Marks a review item as reviewed.

Parameters​

itemId​

string

decision​
notes?​

string

reviewerId​

string

status​

"approved" | "flagged" | "rejected"

Returns​

boolean

removeTenantOverrides()​

removeTenantOverrides(tenantId): boolean

Defined in: security/StepUpAuthorizationManager.ts:629

Removes tenant overrides.

Parameters​

tenantId​

string

Returns​

boolean

resetStatistics()​

resetStatistics(): void

Defined in: security/StepUpAuthorizationManager.ts:700

Resets statistics.

Returns​

void

setTenantOverrides()​

setTenantOverrides(overrides): void

Defined in: security/StepUpAuthorizationManager.ts:622

Sets tenant-specific risk overrides.

Parameters​

overrides​

TenantRiskOverrides

Returns​

void