scoped-approval-register

An append-only approval register prevents scope drift by preserving the grantor's verbatim wording and enforcing deny-by-default authorization. It treats actions as authorized only when an active register entry's allowed scope clearly covers them, avoiding dangerous paraphrasing.

To handle scope changes without overwriting history, create a new append-only register entry for the widened scope and mark the old entry as superseded. This maintains a complete audit trail of all authorization changes and prevents history rewriting.

Deny-by-default authorization treats an action as authorized only when an active register entry's allowed scope explicitly covers it. Combined with non-empty forbidden scope, it prevents agents from taking actions outside the granted boundaries without a matching approval citation.

Yes, an approval register supports tracking human-granted approvals for PR comments, issue replies, and chat-based grants. It records evidence links and manages expiry, providing audit-ready governance for repository actions.

A scoped approval register is not suitable when you need to rewrite or delete authorization history, require empty forbidden scope, or lack verbatim approval text to preserve. It mandates append-only entries, non-empty forbidden scope, and evidence pointers for compliance.