# Answer approvals in the Console

Where a paused run shows up in the Console, how to answer a permission request or a question, and how the Supervision inbox orders what is waiting.

When an agent reaches an action you marked as approval-required, or asks a question, the run
pauses and the request appears in two places: inline in the session, and in the Supervision inbox
across the tenant. Answering from either resumes the same run.

- **Sessions** shows the request as a card in the run's timeline, with allow and deny, or an
  answer box for a question.
- **Supervision** lists every pending request in the tenant in its Inbox, longest-waiting first, with a
  "Mine" filter for the sessions you started.
- The first answer wins. A second reviewer sees the recorded decision, not a second prompt.
- A request has an expiry; an expired request ends the run's wait with a refusal, recorded.
- Only a person can answer. A request signed with an agent's delegated credential is refused.

## In the session

Open Sessions, select the session, and find the card at the point where the run paused. A
permission card names the tool and shows its input; a question card shows the question. Choose
Allow or Deny, or type the answer, and the run continues from where it stopped. The card stays in
the timeline as the record of the decision and who made it.

## In the Supervision inbox

The Supervision inbox collects pending requests from every session in the selected tenant, ordered by how long
each has waited, so a reviewer can work through them without opening sessions one by one. Each row
names the agent, the tool or question, who started the session, how long it has waited, and when
it expires. Approve, deny (with an optional reason), or answer directly on the row; "Open session"
takes you to the full timeline.

Two filters shape the list. **Mine** shows requests from sessions you started and is the default
for developers and viewers. **All in tenant** shows every session's requests and is the default
for organization owners and admins. Either way, any member of the tenant may answer any request;
the filter is a view, not a permission.

After you answer, the row reads "Answered, delivering" until the agent has received it, then
"Delivered". A parked session is restored to deliver the answer; viewing the inbox never restores
one. New requests appear within one reconciler sweep, so the header shows when the list was read
rather than claiming to be live. Two identical requests from one session show as one row.

## Rules the Console follows

- A decision is accepted exactly once. If someone else answered first, you see their answer.
- Closing the tab does not lose the request. It is a control-plane record, and the agent's
  runtime may be suspended while it waits; it is restored when you answer.
- Denying a permission does not fail the run. The agent learns the tool was refused and decides
  what to do next, which may be to finish without it or to ask.
- Everything here is also available to your application through the interactions API, so a
  product can present the same decision in its own interface. See
  [Approval-required actions](/guides/run/approval-required-actions).

## Where to go next

- [Tour the Console](/getting-started/console-tour)
- [Policy, approvals, and evidence](/concepts/governance): where approvals sit among the other
  controls.