Surfacing the three tiers in the tool layer: allow (a token is held), deny (never issued or revoked; canGrant answers grantability without minting, ExaDev/wire-mesh#79), ask (capability-request held open for a decision).
The work here is what an agent sees when an action would land in the ask tier, and how a human approves or denies from the user principal: the approval prompt, its routing to the right device or principal, and the outcome feeding back into the held request.
Surfacing the three tiers in the tool layer: allow (a token is held), deny (never issued or revoked; canGrant answers grantability without minting, ExaDev/wire-mesh#79), ask (capability-request held open for a decision).
The work here is what an agent sees when an action would land in the ask tier, and how a human approves or denies from the user principal: the approval prompt, its routing to the right device or principal, and the outcome feeding back into the held request.