# Request review card (60 seconds)

You received an `authorization_request` from an agent. The agent has stopped and is waiting. Decide:

1. Scope (10 s): exactly one action? Wildcards (`*`, `all`) = reject at once.
2. Resource (10 s): exactly one named resource? Is it the one the task truly needs?
3. TTL (5 s): 60 minutes at most, shorter is better. One-time only.
4. Why (15 s): read `reason` and `blocking_policy` (rule id, text, source). Does the task justify it? Is the policy contradiction real? If two rules conflict, fixing the policy may be better than granting a right.
5. Blast radius (10 s): what can go wrong with this action on this resource if misused? Reversible? Contains patient or personal data?
6. What to deny (10 s): deny if scope is broader than the task, the reason is vague, the request came from another agent rather than the blocked task, or you cannot verify who asked.

If approving: fill `mandate_template.json` yourself, apply the access change in your own system, and record the nonce as used.
If unsure: deny. Waiting costs little; the agent never proceeds on its own authority.