E1710. Secret approval required

Severity: ERROR. Class: SecretApprovalRequired (subclass of PolicyDeniedError).

What happened

Secrets:read denied. The SDK got this code on a get_secret() call where the agent did NOT call request_approval() to escalate.

Why it matters

Secret reads are higher-stakes than tool calls. The behavior on this deny is to require an explicit approval request from the agent, not a silent fail-closed -- and "explicit" is literal: the agent's code makes the request_approval() call, no policy tag makes it for you.

How to fix

Wrap get_secret() in a request_approval() flow like you would guard().

Removing escalate_on_deny: true from the secret-read rule will NOT change this error. That tag is currently inert (#2391) and never raises a request, so it cannot be what put the read behind approval.

Catching this error

except PolicyDeniedError catches this.

See also

• Approval Workflow. The parent concept
• SDK: Approval callback. The request_approval + wait API
• Errors index