How to add human approval before an agent hits a vendor API

1. Why this guide matters

Vendor APIs often look like normal tool calls in development and like procurement risk in production. The safest pattern is to pause only the calls that cross a threshold.

NORNR gives you that pause point without forcing every request through a human.

2. Install what you need

npm install @nornr/sdk

This guide uses the hosted NORNR path at https://nornr.com, so you can validate the decision flow without standing up the full local stack first.

3. Create the governed wallet

import { Wallet } from "@nornr/sdk";

const wallet = await Wallet.create({
  owner: "vendor-agent",
  dailyLimit: 100,
  requireApprovalAbove: 50,
  baseUrl: "https://nornr.com",
});

This wallet is the mandate. It sets the budget and review threshold before the framework-specific workflow is allowed to continue.

4. Apply it in the workflow

const decision = await wallet.pay({
  amount: 61,
  to: "vendor-api",
  purpose: "external vendor action",
});

if (decision.status === "approved") {
  await fetch("https://vendor.example.com/orders", { method: "POST" });
} else if (decision.requiresApproval) {
  console.log("Hold for operator approval", decision);
} else {
  console.log("Blocked by policy", decision);
}

The key pattern stays the same across frameworks: ask NORNR for a decision first, then let the expensive or externally billable step run only if policy says yes.

5. What to expect

• approved means the workflow can continue immediately inside its mandate.
• queued means the request crossed an approval threshold and should wait for review.
• rejected means policy did not allow the action to proceed.

That three-way split is what makes the pattern useful: low-risk work stays fast, higher-risk work becomes reviewable, and clearly out-of-policy work never leaves the workflow.

6. Where to go next

• Hosted quickstart
• Control room
• Guides library