diff --git a/data/scripts/o b/data/scripts/o
index 571a930..88e51e7 100755
--- a/data/scripts/o
+++ b/data/scripts/o
@@ -278,9 +278,10 @@ cmd_log() {
 cmd_approve() {
     if [[ -z "$CTX_SESSION" ]]; then
         echo "error: approve requires session context" >&2
-        echo "  usage: o <session> approve" >&2
+        echo "  usage: o <session> approve [id]" >&2
         exit 1
     fi
+    local req_id="${1:-}"
     local bypass_path="session/$CTX_SESSION/bypass"
     local pending
     pending=$(ollie-9p read "$bypass_path" 2>/dev/null || true)
@@ -294,11 +295,16 @@ cmd_approve() {
         echo "error: could not parse bypass request" >&2
         exit 1
     fi
+    # If request ID specified, verify it matches
+    if [[ -n "$req_id" && "$req_id" != "$id" ]]; then
+        echo "error: request id mismatch (pending: $id, requested: $req_id)" >&2
+        exit 1
+    fi
     local cmd cwd
     cmd=$(echo "$pending" | jq -r '.cmd' 2>/dev/null)
     cwd=$(echo "$pending" | jq -r '.cwd' 2>/dev/null)
-    echo "approving: $cmd"
-    echo "      cwd: $cwd"
+    echo "[$id] approving: $cmd"
+    echo "          cwd: $cwd"
     printf '%s approve' "$id" | ollie-9p write "$bypass_path"
     echo "approved"
 }
@@ -306,9 +312,10 @@ cmd_approve() {
 cmd_deny() {
     if [[ -z "$CTX_SESSION" ]]; then
         echo "error: deny requires session context" >&2
-        echo "  usage: o <session> deny" >&2
+        echo "  usage: o <session> deny [id]" >&2
         exit 1
     fi
+    local req_id="${1:-}"
     local bypass_path="session/$CTX_SESSION/bypass"
     local pending
     pending=$(ollie-9p read "$bypass_path" 2>/dev/null || true)
@@ -322,11 +329,16 @@ cmd_deny() {
         echo "error: could not parse bypass request" >&2
         exit 1
     fi
+    # If request ID specified, verify it matches
+    if [[ -n "$req_id" && "$req_id" != "$id" ]]; then
+        echo "error: request id mismatch (pending: $id, requested: $req_id)" >&2
+        exit 1
+    fi
     local cmd cwd
     cmd=$(echo "$pending" | jq -r '.cmd' 2>/dev/null)
     cwd=$(echo "$pending" | jq -r '.cwd' 2>/dev/null)
-    echo "denying: $cmd"
-    echo "    cwd: $cwd"
+    echo "[$id] denying: $cmd"
+    echo "        cwd: $cwd"
     printf '%s deny' "$id" | ollie-9p write "$bypass_path"
     echo "denied"
 }
@@ -456,8 +468,8 @@ Commands (availability depends on context):
   Session level (o <session> ...):
     ls                    List session contents (agents, config)
     ctl <cmd>             Session control (kill, pause, resume)
-    approve               Approve pending bypass request
-    deny                  Deny pending bypass request
+    approve [id]          Approve pending bypass request
+    deny [id]             Deny pending bypass request
     read/write <path>     Access session files
 
   Agent level (o <session>/<agent> ...):
@@ -467,8 +479,8 @@ Commands (availability depends on context):
     prompt                Interactive multi-line prompt REPL
     log [-n N]            Show last N lines of agent log
     tui                   Launch tmux layout
-    approve               Approve pending bypass request (session-level)
-    deny                  Deny pending bypass request (session-level)
+    approve [id]          Approve pending bypass request (session-level)
+    deny [id]             Deny pending bypass request (session-level)
     read/write <path>     Access agent files (chat, cfg, etc.)
 
   Common:
@@ -486,6 +498,7 @@ Examples:
   o myproj/coding prompt      # interactive prompt
   o myproj/coding read chat   # read chat stream
   o myproj approve            # approve pending bypass
+  o myproj approve 42         # approve specific request by id
   o myproj/coding approve     # same (bypass is per-session)
   o generate "explain monads" # one-shot, no session
 EOF