ctrlrun.ApprovalRequired — class, defined at src/ctrlrun/errors.py:88
request_id is what ctrlrun approve takes (SPEC §4.3).
Raised instead of blocking, so an agent loop can surface the request and come back with
ctrlrun.with_approval(request_id) in context.