@@ -17,7 +17,8 @@ bundle is self-contained (fonts bundled as woff2, strict CSP, no runtime CDN) fo
 
 - `src/main.tsx` - entry; mounts the theme + auth providers and the router.
 - `src/App.tsx` - route table (Fleet `/`, Nodes `/nodes`, node detail `/nodes/:name`, Operators,
-  Agent keys `/agent-keys`, Audit, 404). The MCP sign-in consent page `/oauth/consent` is routed
+  Agent keys `/agent-keys`, Approvals `/approvals` (accepts `?id=<approval>` from the manager's
+  approval link), Audit, 404). The MCP sign-in consent page `/oauth/consent` is routed
   outside the auth gate on purpose: the manager authenticates that request with the browser's
   client certificate, and it talks to `/oauth2/consent/<id>` with plain `fetch`, not Connect.
 - `src/components/layout/` - app shell: header, sidebar nav, wordmark, theme toggle, auth gate.
@@ -44,3 +45,7 @@ bundle is self-contained (fonts bundled as woff2, strict CSP, no runtime CDN) fo
   fields ignored, so a stale stub drops a new field without an error, and a config read, edited and
   applied through the UI then clears that field on the node. `src/lib/wire-fields.test.ts` pins
   the newer fields; extend it when you refresh.
+- The Approvals nav badge counts pending approvals through `listApprovals`. It recounts on every
+  navigation, every 30 seconds, and when `decideApproval` dispatches the `APPROVALS_CHANGED`
+  window event (`src/lib/approvals.ts`). A new surface that changes an approval should go through
+  `decideApproval` so the badge stays current.
@@ -30,6 +30,7 @@ The Fleet Manager serves an MCP endpoint so AI agents can manage the fleet. An a
 
 - 🔑 **Sign-in consent** at `/oauth/consent?req=<id>`. An MCP client's OAuth sign-in lands here in the operator's browser. The page shows the client's name, the loopback host the code returns to, and the operator certificate that will own the key, and lets the operator pick a level ceiling (up to their own level) and a label before choosing Approve or Deny. It sits outside the console's Log in step, because the manager authenticates the request with the certificate the browser presents. It talks to the manager's `/oauth2/consent/<id>` endpoint as plain JSON on the same origin.
 - 🗝️ **Agent keys** (next to Operators) lists your keys with their client, ceiling, creation time, last use and status, and lets you revoke one. An admin can switch to every operator's keys. **Create key** mints a key for a client that cannot open the browser sign-in. The key is shown once, with a copy button, and is discarded when the dialog closes; the manager keeps only a hash of it.
+- ✋ **Approvals** (next to Agent keys, with a count of pending requests) is where a person decides the step-up requests an agent raises before a tool that changes the fleet runs. It lists pending requests by default, and a status filter switches to approved, denied, expired, used or all. Each row shows the tool, a summary, who asked (CN), the agent key, the required level, when it was created and expires, and its status. **Approve** and **Deny** each ask for confirmation, repeating the summary and the full request digest so it can be matched against what the agent reported. The buttons are disabled unless the request is pending and your level is at least the one it requires; the manager enforces the same rule, and an agent key can never list or decide an approval. The manager's approval link opens `/approvals?id=<id>`, which shows every status and highlights that request.
 - 📜 **Audit** shows who acted (the certificate CN, and whether it acted directly or through an agent key), the surface it came through (web, mcp or api), the MCP tool and the outcome. Entries recorded before the manager captured an actor show a dash.
 
 A key is bound to the operator certificate that created it. It stops working when that certificate is revoked or renewed, and its effective level is the certificate's live level or its ceiling, whichever is lower.