FUNCTION TOOLS · APPROVAL AND EFFECT WORKBENCH
Approval workflow: bind review to operation intent
Edit real JSON arguments, inspect policy gates and watch an approved local function change a synthetic ledger.
Scroll the diagram left or right to inspect every label.
Request being reviewed
Your experiment
Grant operator permission without approval and observe the stop. Approve, edit the payload, and confirm the previous approval cannot authorize the changed operation.
Each gate takes eight inspection seconds, or use Next gate. Only reaching the final stage applies the planned local effect. Restart preserves the ledger; Reset synthetic ledger clears this page’s fictional state.
Returned output
Inspect the synthetic ledger
This browser-only gateway uses six handcrafted functions, not an ADK/Gemini service implementation. No emails, calendar invitations, network requests, real files, database queries or arbitrary code are executed. Email recipients are restricted to example.test; virtual files are two allowlisted map keys; arithmetic uses named operators, never eval. Calendar intervals use one synthetic day and no time zones or recurrence. Search is literal matching over three fixture sentences. Approval, role rules, hooks and receipt storage are illustrative application policies, not production security controls. Redaction changes two output fields only and is not a privacy or compliance guarantee. The ledger is held in page memory and is lost on reload. Function-tool concepts · Action-confirmation concepts.
Bind approval to the exact requested effect
The local gateway separates schema validation, a before-tool hook, role permission, approval, idempotency, execution and an after-tool hook. A mutation needs both operator permission and approval matching the selected tool and its exact argument object. Approval is not a general permission to perform later edits. This page changes only an in-memory synthetic ledger. The email outbox, calendar, virtual files and key/value store are fixtures; no messages are sent and no external application is modified.
Prepare arguments and policy
Function chooses mock email, calendar, files, database, search or arithmetic. Example loads valid, malformed or boundary arguments. JSON arguments can be edited directly and invalidate prior approval. Viewer allows reads; Operator may request mutations but still needs approval. Hook policy can block mutations before execution or redact recipient/file content in returned output after execution. Redaction does not erase internal ledger data. Operation key identifies a mutation intent; reusing a key for different arguments is rejected when its receipt exists.
Exercise approval and receipt reuse
Choose mock email, valid example and Operator. The preview blocks until Approve exact payload is selected. Inspect all seven gates to apply one mock outbox entry. Restart inspection and repeat without changing the payload: receipt reuse returns the stored output without adding an entry. Reuse receipts becomes adjustable after a successful mutation; disable it to observe a duplicate local effect on another completed run. Editing the subject revokes approval. After approving that new payload, the old key still conflicts with the retained receipt; supply a new key for a genuinely new intent.
Test rejection before effect
Malformed JSON fails before role or approval. The boundary email uses an outside.test address and fails this fixture’s example.test-only schema. Calendar intervals overlapping the reserved six-hundred to six-hundred-sixty minute slot fail at execution without adding an event. Arithmetic division by zero also rejects, even though it passed the basic numeric schema. Read-only tools need neither a mutation key nor approval. Disabled hook and receipt controls indicate that their behavior is not applicable to the current operation.
Inspect without confusing rewind and undo
Play and Pause inspect seven eight-second stages; Next gate advances one. Restart inspection rebuilds the plan while preserving the existing ledger and current approval. Reset synthetic ledger clears effects and receipts and revokes approval. Speed changes inspection pace. An effect is committed only when all gates have been inspected, so rewinding inspection does not undo a prior completed mutation. The model has no durable storage, concurrent approval races, signatures, external identity or transactional remote tool execution. Its local intent signature is a deterministic argument representation, not a security credential.