Human approval gates for Claude Agent SDK

canUseTool / can_use_tool permission callback (plus permission modes/rules and hooks). The Claude Agent SDK fires your canUseTool (TypeScript) or can_use_tool (Python) callback whenever Claude wants to run a tool that is not auto-approved by permission rules or modes. The callback receives the tool name and input, pauses execution until you return a decision, and you respond with PermissionResultAllow (optionally with modified input) or PermissionResultDeny (with a message). Per the docs it can stay pending indefinitely, and a PreToolUse hook plus the PermissionRequest hook can fire external notifications. This is a real PAUSE point in the run.

The callback is in-process and ephemeral. The SDK hands you a decision point but nothing behind it: the docs say presenting the request is up to "your application: a terminal prompt, a web form, a mobile dialog," and they punt external approval systems to custom tools that "connect to existing ticketing, workflow, or approval platforms." There is no durable store of pending requests, no built-in routing to a reviewer in Slack or a web inbox, and no tamper-evident record of who approved what and when. If your process dies while the callback is pending, the request is gone. Storage, human routing, and audit are entirely the developer's to build.

One wrapper is the whole integration surface — the gate is enforced at runtime, before the tool executes.

pip install "pliuz[claude-agent]"
# TypeScript: npm install @pliuz/sdk

from claude_agent_sdk import tool
from pliuz.adapters.claude_agent import gated_tool

@gated_tool(policy="refunds")  # routes to a human before the body runs
@tool("issue_refund", "Refund a customer", {"order_id": str, "amount": float})
async def issue_refund(args):
    # Only runs after a human approves in Slack or the Pliuz web inbox.
    # Reject or edit, and this body never executes. Every decision is
    # recorded in a tamper-evident, EU-hosted audit trail.
    return await payments.refund(args["order_id"], args["amount"])

In production with the Claude Agent SDK, approvals go to Pliuz. The native canUseTool callback gives you an in-process pause point, but you still need somewhere durable to hold the pending request, a way to route it to a human, and a record of the decision. Pliuz takes the call paused at the gate, sends it to a reviewer in Slack or a web inbox to approve, reject, or edit, and only lets the tool execute on approval. Every decision is written to a tamper-evident, append-only, Ed25519-anchored audit trail hosted in the EU (Frankfurt), implementing EU AI Act Article 14 oversight and Article 12 logging mechanically.