(orchestration): Runtime capability elevation via Cedar HITL

Component

API or orchestration

Describe the feature

When a headless agent hits a policy denial for a resource outside its current scope (file path, egress domain, tool), surface a structured capability elevation request to the operator channel; on approval, Cedar issues a narrowed grant and the agent resumes without restarting the task.

Use case

Static allowlists stall unattended agents on edge cases. Mature deployments separate enforce (hard sandbox) from decide (dynamic approval for exceptional access). ABCA Cedar HITL covers tool soft-deny but not general runtime permission expansion.

Proposed solution

1. Extend Cedar actions with capability_elevation_request payload: { resource, action, rationale }.
2. On soft-deny, transition to AWAITING_APPROVAL with elevation-specific event type.
3. Slack/GitHub approve wires to temporary policy overlay (time-boxed, task-scoped).
4. Deny returns agent to alternate path or NEEDS_HUMAN.

Other information

• Complements rfc-runtime-security-telemetry-layer and roadmap Layered credential derivation.
• Different from bgagent nudge (steering content, not permissions).

Acknowledgements

• I may be able to implement this feature
• This might be a breaking change

Acceptance criteria

• Elevation request/approve/deny flow documented in CEDAR_HITL_GATES.md.
• Approved elevation expires automatically; audit in TaskEvents.
• Tests with fixture policies for file-read and egress cases.

Comienza con CEDAR_HITL_GATES.md y sigue la integración de TaskEvents para el flujo soft-deny existente. Después, localiza las pruebas de fixture-policy para los casos de file-read y egress. Se considera terminado cuando estén documentados los comportamientos de request/approve/deny, las elevaciones task-scoped que expiren automáticamente y los eventos de auditoría para cada decisión.