/** Per-action approval override: replaces the risk-class mode for matching refs. */
export type FabricActionApprovalMode = "allow" | "ask" | "deny";
/**
 * Parse `approvals.actions`. Keys are exact refs (`delegate.dispatch`) or a
 * provider wildcard (`delegate.*`); every other form is a hard config error,
 * because a silently dropped `deny` would widen authority.
 */
export declare const approvalActionOverridesValue: (value: unknown) => Record<string, FabricActionApprovalMode> | undefined;
/** Exact ref beats provider wildcard; undefined falls back to the risk-class mode. */
export declare const actionApprovalOverride: (overrides: Readonly<Record<string, FabricActionApprovalMode>> | undefined, ref: string) => FabricActionApprovalMode | undefined;
//# sourceMappingURL=approval-overrides.d.ts.map