> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt > Use this file to discover all available pages before exploring further. # Approvers and Activity > Choose who answers each approval card, require two people, allow break-glass, and audit what each Rule decided Approvers decide who may answer an approval card. Activity shows what each [Rule](/guide/approvals/rules) decided and who approved. ## Prerequisites * The workspace Admin role to change approvers, the two-person rule, or break-glass. Developers and Viewers can view them. ## Default approvers **Default approvers** is a built-in group. It answers every ask that no Rule sends to another group. You cannot rename or delete it. When it has no members, every Developer or above can approve. Viewers can never approve, so you cannot add them. ## Approver groups A group answers the asks of the **Ask first** Rules that name it, instead of Default approvers. Open **Approvals → Approvers** and click **New group**. Enter a **Group name**, such as `On-call SRE`, add **Members**, then click **Create group**. Open an **Ask first** Rule on the **Rules** tab. Under **Who approves this?**, pick the group and save. **Success state:** the group row on the **Approvers** tab says "Used by 1 Rule". When one write matches more than one Rule: | Matched Rules | Who may approve | | - | - | | No Rule names a group | Default approvers | | One Rule names a group | Members of that group | | Rules name different groups | People who are in every named group | | No one is left | Workspace owners and admins | If no one at all is left, the card says "No one else can approve this. Ask a workspace owner to add an approver." You cannot delete a group while a Rule names it. ## Two-person rule Turn on **The person who started a run cannot approve it** to make another approver answer. Then pick what it **Applies to**: | Applies to | Who must approve | | - | - | | **Destructive actions** | Another approver for deletes, sessions, and any action of an unknown type | | **All writes** | Another approver for every write | This covers every ask, not only asks from a Rule. You need at least 2 approvers to turn it on. To require two people for one Rule only, select **Needs 2 different people** in that Rule. The person who started the run sees no **Approve** button on the card. The card says who else can approve. ## Break-glass Break-glass lets a workspace owner or admin run one call that a **Deny** Rule refused. It is off by default. 1. Turn on **Let owners and admins break glass** on the **Approvers** tab. 2. When a **Deny** Rule refuses a call in a chat with a person in it, an owner or admin clicks **Break glass…** on the card. 3. They give a reason of 20 characters or more within 15 minutes. The call runs once. Every workspace owner is told, and the reason stays in the audit log. The agent cannot ask for break-glass. Break-glass is a security event. It never runs an **Always blocked** call or a call that a Rule marked **Never allow break-glass**. ## Check Activity Open **Approvals → Activity** to audit your Rules. The table has one row per Rule for the period you pick. | Column | What it shows | | - | - | | **Rule**, **Source**, **Accepted by** | What the Rule is, where it came from, and who accepted it | | **Allowed**, **Asked first**, **Refused** | How many calls the Rule decided each way | | **Approved**, **Declined**, **Approvers** | How people answered its asks, and who answered | | **Break-glass** | How many times someone broke glass on it | Filter by **Source**, **Effect**, or **Result**, or search Rules or people. Click **Export CSV** to download every Rule in the period. The **Overview** tab shows the same totals for the last 7 days: calls that ran, asked a person, or were refused. ## Related See how Rules, the mode, and approvers decide each write Review workspace security events, break-glass included This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.