Use case

Ops mutations need a human

terraform apply, kubectl apply, and docker push require approval before they run.

Platform / ops adjacent developers · pack ops-approve

Infra mutations are high-blast-radius. ops-approve marks them require_approval so an agent cannot silently apply.

mayrun run 'terraform apply'
mayrun run 'kubectl apply -f deploy.yaml'
mayrun run 'docker push …'

Use alongside dangerous-defaults — ops approval does not replace destructive denials.