Run With Approval

Request exact sensitive scope, then run one command in a fresh sandbox.

CLI lobby access run

Parameters

Name	Type	Description
`kind`	enum	`network`, `read`, `write`, or `operation`.
`target`	string	Exact host, path, or sensitive-operation description.
`reason`	string	User-facing justification.
`command`	string	Command up to 20,000 characters.

Operation approval is command-hash-bound. Denied, expired, or used approvals do not run.

lobby access run network api.internal.example:443 \
  --reason 'Read deployment status' \
  -c 'curl https://api.internal.example/status'

Waiting for approval: network api.internal.example:443

After approval, the command runs once in a fresh sandbox and returns its output and exit status.