Skip to main content
Approvers decide who may answer an approval card. Activity shows what each Rule decided and who approved.

​
Prerequisites

  • The workspace Admin role to change approvers, the two-person rule, or break-glass. Developers and Viewers can view them.

​
Default approvers

Default approvers is a built-in group. It answers every ask that no Rule sends to another group. You cannot rename or delete it. When it has no members, every Developer or above can approve. Viewers can never approve, so you cannot add them.

​
Approver groups

A group answers the asks of the Ask first Rules that name it, instead of Default approvers.
1

Create the group

Open Approvals → Approvers and click New group. Enter a Group name, such as On-call SRE, add Members, then click Create group.
2

Name the group in a Rule

Open an Ask first Rule on the Rules tab. Under Who approves this?, pick the group and save.Success state: the group row on the Approvers tab says “Used by 1 Rule”.
When one write matches more than one Rule: If no one at all is left, the card says “No one else can approve this. Ask a workspace owner to add an approver.” You cannot delete a group while a Rule names it.

​
Two-person rule

Turn on The person who started a run cannot approve it to make another approver answer. Then pick what it Applies to: This covers every ask, not only asks from a Rule. You need at least 2 approvers to turn it on. To require two people for one Rule only, select Needs 2 different people in that Rule. The person who started the run sees no Approve button on the card. The card says who else can approve.

​
Break-glass

Break-glass lets a workspace owner or admin run one call that a Deny Rule refused. It is off by default.
  1. Turn on Let owners and admins break glass on the Approvers tab.
  2. When a Deny Rule refuses a call in a chat with a person in it, an owner or admin clicks Break glass… on the card.
  3. They give a reason of 20 characters or more within 15 minutes. The call runs once.
Every workspace owner is told, and the reason stays in the audit log. The agent cannot ask for break-glass.
Break-glass is a security event. It never runs an Always blocked call or a call that a Rule marked Never allow break-glass.

​
Check Activity

Open Approvals → Activity to audit your Rules. The table has one row per Rule for the period you pick. Filter by Source, Effect, or Result, or search Rules or people. Click Export CSV to download every Rule in the period. The Overview tab shows the same totals for the last 7 days: calls that ran, asked a person, or were refused.

Approvals

See how Rules, the mode, and approvers decide each write

Audit Logs

Review workspace security events, break-glass included