Approval Rules

A Rule names one kind of write and decides it before the Approval mode does. Agents propose Rules as they work, and a workspace admin accepts each one.

Prerequisites

The workspace Admin role to accept, edit, or turn off a Rule. Developers and Viewers can read Rules.
At least one cloud account or cluster connection for Find rules

What a Rule contains

Field	What it means
Effect	Allow runs the write. Ask first waits for a person. Deny refuses it.
Operations	The calls it covers, written `service:Name`. A `` matches any part, so `ec2:Stop` or `:`.
Connection type and Connections	The connections it covers. Leave Connections empty for every connection of that type.
Runs from	The run types it covers: Chat, Resolve, Optimize, Automations, Review. Empty means all runs.
Window	How long the Rule lasts. Empty means no expiry.
Note	Why the Rule exists
Who approves this?	For an Ask first Rule only: Default approvers or one approver group, and whether it needs 2 different people
Never allow break-glass	For a Deny Rule only: no one can override it

A Rule never matches a read. An Allow Rule never matches a call that CloudThinker cannot identify, and an Allow on every operation must name its connections. The Access row shows how risky the Rule is: Write, Destructive, Session, Sensitive read, or Every operation.

Find Rules for your workspace

Open the Rules tab

Open Approvals → Rules.

Start a check-up

Click Find rules. Pick a focus: Hand off toil, Guard production, or Clean up Rules. Then start the check-up.CloudThinker reads your connections, Optimize findings, incidents, alerts, and approval history, then proposes Rules in a chat. Nothing changes until you accept.

Wait for the proposals

A check-up takes 5–10 minutes. The button reads Check-up running and opens that chat.Success state: the banner says how many Rules need your review.

An agent can also propose a Rule in any chat. To turn a call you approve into a Rule, click Approve and draft rule on its approval card.

Review and accept Rules

Open the review

On the Rules tab, click Review in the banner. You can also open the Needs review tab.

Check each Rule

Open a Rule to read it. What would change replays the last 7 or 30 days of calls against the Rule. It tells you how many calls would run without asking, ask first, or be refused, with example commands.

Select and accept

Nothing is selected at first. Select up to 50 Rules, then click Accept N or dismiss them. An Allow on every operation, a destructive Allow, or a flagged Allow asks you to confirm first.Success state: the toast says “Accepted N Rules” and offers Undo. A Rule that failed stays in the list with its reason.

A proposal that overlaps Always blocked cannot be accepted. It would never run, so dismiss it. The same proposals show as cards in the chat that made them. Accept on the card does the same as Accept on the Rules tab.

Write or change a Rule

Open a Rule on the Rules tab. An admin sees the Edit Rule form at once.

Save on an active Rule replaces it at once, and the old version moves to Replaced.
Save on a proposal keeps it under Needs review. Accept it to turn it on.
Change with AI opens a chat that drafts the change as a new proposal.

To stop a Rule, open it and click Disable. To bring back a dismissed Rule, open it and click Restore. It comes back with no expiry.

Windows

A Window is a short Rule that someone made from an approval card with Approve for…. It covers the exact operation and connection that the person approved, and it always ends: after 1 hour, at the end of This incident, or after 30 days. Windows show on the Rules tab with the source Window and their end time. You cannot edit a Window. To end it early, click Disable in its row menu.

Filter the list

The Active, Needs review, and Dismissed tabs show their counts. Filter by Source, Connector, Runs from, or Approved by, or search by name.

Source	Who made the Rule
Person	A person in the Rule form
Agent	An agent proposal or a check-up
Runbook	A runbook
Imported	An old Trust or runbook grant, or a policy file
Window	Approve for… on an approval card

Export and import your policy

Keep your policy as a file, for example in Git, and load it into another workspace.

Export active Rules downloads policy-<workspace>-<date>.yaml. It holds your active Rules, approver groups, modes, and the two-person setting. It never holds Windows, proposals, or secrets.
Import policy reads a YAML or JSON file of up to 1 MB. It first shows what would change and lists each problem by line and field. It applies the file only when you click, and it keeps the file if the apply fails.

Both actions are in the … menu on the Rules tab. An imported Allow Rule waits for review, unless you turn on Activate Allow Rules.

version: 1
level: auto_ai_ask
origin_levels:
  automation: auto_ai_refuse
approver_groups:
  - name: On-call SRE
    members: [sre-lead@example.com]
rules:
  - slug: stop-staging
    description: Let the agent stop staging instances
    effect: allow
    connector: aws
    aliases: [aws-staging]
    operations: [ec2:StopInstances]
  - slug: ask-before-rds-delete
    effect: require_approval
    connector: aws
    operations: [rds:Delete*]
    approver_group: On-call SRE

Troubleshooting

Find rules is not shown

Your workspace has the agent’s policy tool turned off. Ask a workspace admin. You can still write Rules in the form.

Accept is turned off

You need the workspace Admin role, or the Rule overlaps Always blocked. A Rule that changed after you opened it needs a new review: reload it, then accept.

An Allow Rule does not let a write run

Check the mode. Manual asks before every write, also one that a Rule allows. Then check Runs from and Connections: a Rule matches only the run types and connections it names.

Organization

Automation & Autonomy

Connections

Platform Settings

Security

Billing

Prerequisites

What a Rule contains

Find Rules for your workspace

Review and accept Rules

Write or change a Rule

Windows

Filter the list

Export and import your policy

Troubleshooting

Next steps

Approval mode

Approvers and Activity

​Prerequisites

​What a Rule contains

​Find Rules for your workspace

​Review and accept Rules

​Write or change a Rule

​Windows

​Filter the list

​Export and import your policy

​Troubleshooting

​Next steps

Approval mode

Approvers and Activity

Prerequisites

What a Rule contains

Find Rules for your workspace

Review and accept Rules

Write or change a Rule

Windows

Filter the list

Export and import your policy

Troubleshooting

Next steps