The important detail is whether approval binds to the exact proposed action, including the recipient, repository, issue, or data being sent, rather than just “allow Gmail” or “allow this endpoint.” How granular are the gateway policies for APIs where read and write actions share the same host?

jonathan from OneCLI here, yes - approval binds to the exact req by opening it (method, URL, body) when there’s a matching policy defined. then the gateway holds the call and the card shows the parsed payload.

just to clarify how it works - on same host, rules match based on method + path + body, not only the host. for example, GET /calendar/v3/* can be allowed while POST needs approval.