# A coding agent can request a discount. Who gets to approve it? > Source: > Published: 2026-09-07 20:53:52+00:00 An approval rule becomes useful when you can test what happens on both sides of it: the forbidden action is refused, and the permitted decision leaves evidence. A happy-path demo alone cannot show that distinction. Here is a runnable example using Accordo, the open-source framework coding agents use to build custom CRMs. A synthetic customer wants 30 seats of an Enterprise Plan and requests 25% off. The existing policy permits automatic approval through 10%; above that, through 50%, it requires a user decision. You need Git, Node.js 22.16 or newer, npm, and internet access for cloning and dependency installation. Start in an empty working directory: ``` git clone https://github.com/khaoss85/agent-crm.git framework-source cd framework-source git checkout 3b5b5f0c4c3e582e48d54501136024b064756daa node --no-warnings examples/recipes/quote-approval/run.mjs ../my-quote-crm ``` The pinned [recipe source](https://github.com/khaoss85/agent-crm/blob/3b5b5f0c4c3e582e48d54501136024b064756daa/examples/recipes/quote-approval/run.mjs) creates a project, installs its dependencies and composes the existing commercial package. It then starts a temporary server on localhost and drives the public SDK through HTTP. The catalog is a fixture; the business journey does not call an external provider. It uses source from the checkout, independently of the npm scaffolder release. The script contains assertions for each transition: `pending_approval`.` HUMAN_APPROVAL_REQUIRED`. The quote and approval remain pending, and no business audit entry is added.`approved`, with one user decision audit and a completed trace. The refusal also has a failed trace. That is a useful distinction: recording an unsuccessful attempt should not manufacture a successful business decision. ``` cd ../my-quote-crm cat data/quote-approval-receipt.json npm run verify npm run crm -- app inspect --json ``` In the receipt, inspect `agentRefusal`, `refusalTrace`, `decision`, `humanAudit` and `approvalTrace`. The quote, version and approval identifiers connect those records. `sourceCommit` and `recipeSha256` identify the implementation used. The local database remains in `data/accordo.sqlite`; another replay needs a new target directory. Both identities are scripted and asserted locally. No person authenticates or clicks Approve during this replay. Production needs verified identity and explicit authorization configuration; the `sales-manager` approval key is a label, not an authenticated role. This is not an agent-build benchmark or a production deployment. Accordo vendors source into the project you own. You can review and adapt the rules while keeping the refusal checks. [The full walkthrough includes the client brief and recorded execution](https://accordo.dev/blog/run-a-b2b-quote-approval-workflow.html?utm_source=dev&utm_medium=syndication&utm_campaign=quote-approval). We are looking for three teams with a real quoting or approval process to try a bounded pilot. If that sounds relevant, leave a comment with the process and the rule that must hold. Please use a synthetic example and omit customer records or other confidential information. We will agree the scope and success criteria before starting.