Interface ApprovalRecord

Connector ids an approval grants (breakwater write gate). Recorded at creation by trusted server-side code — the grant provider derives requestContext grants from these on approved records only.

Latest delegation target (also reflected in claimedBy).

Workflow-provided reviewer context (typically the suspend payload).

Runtime-owned monotonic resume ordinal of that suspension — undefined for a step's FIRST suspension, 1,2,… on successive re-suspensions. Pairs with suspendedAt in the exact grant binding as the collision-free tie-breaker: unlike resumedAt the runtime increments it on every resume regardless of payload, so two same-step suspensions stay distinguishable even when their suspendedAt collide within a millisecond.

Epoch-ms resumedAt of that suspension (core clock). INFORMATIONAL audit metadata only — Mastra stamps it solely on a payload-bearing resume, so it is NOT the grant tie-breaker (that is resumeCount).

Server-authored resume topology. Never accepted from the HTTP create body.

Explicit run-scoped standing grant: a step-less record mints its connectors on EVERY leg of the run. Opt-in only — a step-less record WITHOUT this flag mints nothing, because "absent field => maximal privilege" is an inverted default. Suspend-observation bridges must never set this (they always carry a stepPath); only trusted code that deliberately wants a run-wide capability does.

Suspended step path this approval unblocks, e.g. ['approval'].

Epoch-ms suspendedAt of the suspension this approval binds to (core clock) — see CreateApprovalInput.suspendedAt. Grant minting requires an EXACT match with the resumed leg's suspension timestamp when present, paired with resumeCount.

The owning tenant. STAMPED by the bound store from its own constructor field — never accepted from input (CreateApprovalInput deliberately has no tenantId: a field that cannot be supplied cannot be spoofed). Every read/write predicate carries it.