ADR 0004: Approval gates on blast radius, not on deploys - Tinycloud

Status: Accepted · 2026-08-20

Context

If every deploy needs approval, agents stop being useful and humans start rubber-stamping. If nothing needs approval, the platform is a faster path to shadow IT.

Decision

Deploys are ungated by default. Approval is required only when a change widens blast radius in production:

Reason	Trigger
`NEW_PRODUCTION_CAPABILITY`	a capability the previous revision did not have
`RAW_SECRET_ACCESS`	a raw secret the previous revision did not receive
`EGRESS_ALLOWLIST_EXPANDED`	a new outbound host
`VISIBILITY_WIDENED`	private → organization → public
`DESTRUCTIVE_MIGRATION`	a migration that drops or rewrites data

Preview environments skip capability approval; they get sandbox connections and an empty database, so the risk is different in kind. A pending deployment sits in awaiting_approval — a pause, not a failure. The plan stays valid, and approving resumes the same deployment rather than starting a new one.

Requesting a capability never approves it, even for an admin, unless organization policy disables the requirement.

Consequences

The common case — redeploying an app whose permissions did not change — is fully automatic, which is what makes the platform usable by an agent.
Approval reasons are structured, so the MCP server returns status: "approval_required" with next_actions an agent can follow instead of an error it has to interpret.