OptionalclaimedOptionalclaimedOptionalcommentOptionaldecidedOptionaldecidedOptionaldecisionOptionaldelegatedLatest delegation target (also reflected in claimedBy).
OptionalescalatedOptionalgrantExplicit effective capability scope. Missing on capability-free records and legacy rows; grant derivation treats absence as inert.
OptionalpayloadWorkflow-provided reviewer context (typically the suspend payload).
OptionalrequestedOptionalrequestedPrincipal kind paired with requestedBy. Missing only on legacy rows and
treated as human by separation-of-duties checks (fail closed).
OptionalresumeRuntime-owned monotonic resume ordinal of that suspension — undefined for
a step's FIRST suspension, 1,2,… on successive re-suspensions. Pairs with
suspendedAt in the exact grant binding as the collision-free
tie-breaker: unlike resumedAt the runtime increments it on every resume
regardless of payload, so two same-step suspensions stay distinguishable
even when their suspendedAt collide within a millisecond.
OptionalresumedEpoch-ms resumedAt of that suspension (core clock). INFORMATIONAL audit
metadata only — Mastra stamps it solely on a payload-bearing resume, so it
is NOT the grant tie-breaker (that is resumeCount).
OptionalresumeServer-authored resume topology. Never accepted from the HTTP create body.
OptionalrunExplicit run-scoped standing grant: a step-less record mints its connectors on EVERY leg of the run. Opt-in only — a step-less record WITHOUT this flag mints nothing, because "absent field => maximal privilege" is an inverted default. Suspend-observation bridges must never set this (they always carry a stepPath); only trusted code that deliberately wants a run-wide capability does.
OptionalslaOptionalstepSuspended step path this approval unblocks, e.g. ['approval'].
OptionalsummaryOptionalsuspendedEpoch-ms suspendedAt of the suspension this approval binds to (core
clock) — see CreateApprovalInput.suspendedAt. Grant minting requires an
EXACT match with the resumed leg's suspension timestamp when present,
paired with resumeCount.
OptionaltoolMastra tool-call identity for a tool-call scoped grant.
Connector ids an approval grants (breakwater write gate). Recorded at creation by trusted server-side code — the grant provider derives requestContext grants from these on approved records only.