> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt > Use this file to discover all available pages before exploring further. # Approval Rules > Find, review, accept, and edit the Rules that let a kind of agent write run, ask a person first, or refuse it A Rule names one kind of write and decides it before the [Approval mode](/guide/approvals/approval-mode) does. Agents propose Rules as they work, and a workspace admin accepts each one. ## Prerequisites * The workspace Admin role to accept, edit, or turn off a Rule. Developers and Viewers can read Rules. * At least one cloud account or cluster [connection](/guide/connections/overview) for **Find rules** ## What a Rule contains | Field | What it means | | - | - | | **Effect** | **Allow** runs the write. **Ask first** waits for a person. **Deny** refuses it. | | **Operations** | The calls it covers, written `service:Name`. A `*` matches any part, so `ec2:Stop*` or `*:*`. | | **Connection type** and **Connections** | The connections it covers. Leave **Connections** empty for every connection of that type. | | **Runs from** | The run types it covers: **Chat**, **Resolve**, **Optimize**, **Automations**, **Review**. Empty means all runs. | | **Window** | How long the Rule lasts. Empty means no expiry. | | **Note** | Why the Rule exists | | **Who approves this?** | For an **Ask first** Rule only: Default approvers or one approver group, and whether it needs 2 different people | | **Never allow break-glass** | For a **Deny** Rule only: no one can override it | A Rule never matches a read. An **Allow** Rule never matches a call that CloudThinker cannot identify, and an **Allow** on every operation must name its connections. The **Access** row shows how risky the Rule is: **Write**, **Destructive**, **Session**, **Sensitive read**, or **Every operation**. ## Find Rules for your workspace Open **Approvals → Rules**. Click **Find rules**. Pick a focus: **Hand off toil**, **Guard production**, or **Clean up Rules**. Then start the check-up. CloudThinker reads your connections, Optimize findings, incidents, alerts, and approval history, then proposes Rules in a chat. Nothing changes until you accept. A check-up takes 5–10 minutes. The button reads **Check-up running** and opens that chat. **Success state:** the banner says how many Rules need your review. An agent can also propose a Rule in any chat. To turn a call you approve into a Rule, click **Approve and draft rule** on its approval card. ## Review and accept Rules On the **Rules** tab, click **Review** in the banner. You can also open the **Needs review** tab. Open a Rule to read it. **What would change** replays the last 7 or 30 days of calls against the Rule. It tells you how many calls would run without asking, ask first, or be refused, with example commands. Nothing is selected at first. Select up to 50 Rules, then click **Accept N** or dismiss them. An **Allow** on every operation, a destructive **Allow**, or a flagged **Allow** asks you to confirm first. **Success state:** the toast says "Accepted N Rules" and offers **Undo**. A Rule that failed stays in the list with its reason. A proposal that overlaps **Always blocked** cannot be accepted. It would never run, so dismiss it. The same proposals show as cards in the chat that made them. **Accept** on the card does the same as **Accept** on the Rules tab. ## Write or change a Rule Open a Rule on the **Rules** tab. An admin sees the **Edit Rule** form at once. * **Save** on an active Rule replaces it at once, and the old version moves to **Replaced**. * **Save** on a proposal keeps it under **Needs review**. Accept it to turn it on. * **Change with AI** opens a chat that drafts the change as a new proposal. To stop a Rule, open it and click **Disable**. To bring back a dismissed Rule, open it and click **Restore**. It comes back with no expiry. ## Windows A Window is a short Rule that someone made from an approval card with **Approve for…**. It covers the exact operation and connection that the person approved, and it always ends: after **1 hour**, at the end of **This incident**, or after **30 days**. Windows show on the **Rules** tab with the source **Window** and their end time. You cannot edit a Window. To end it early, click **Disable** in its row menu. ## Filter the list The **Active**, **Needs review**, and **Dismissed** tabs show their counts. Filter by **Source**, **Connector**, **Runs from**, or **Approved by**, or search by name. | Source | Who made the Rule | | - | - | | **Person** | A person in the Rule form | | **Agent** | An agent proposal or a check-up | | **Runbook** | A runbook | | **Imported** | An old Trust or runbook grant, or a policy file | | **Window** | **Approve for…** on an approval card | ## Export and import your policy Keep your policy as a file, for example in Git, and load it into another workspace. * **Export active Rules** downloads `policy--.yaml`. It holds your active Rules, approver groups, modes, and the two-person setting. It never holds Windows, proposals, or secrets. * **Import policy** reads a YAML or JSON file of up to 1 MB. It first shows what would change and lists each problem by line and field. It applies the file only when you click, and it keeps the file if the apply fails. Both actions are in the **…** menu on the **Rules** tab. An imported **Allow** Rule waits for review, unless you turn on **Activate Allow Rules**. ```yaml theme={null} version: 1 level: auto_ai_ask origin_levels: automation: auto_ai_refuse approver_groups: - name: On-call SRE members: [sre-lead@example.com] rules: - slug: stop-staging description: Let the agent stop staging instances effect: allow connector: aws aliases: [aws-staging] operations: [ec2:StopInstances] - slug: ask-before-rds-delete effect: require_approval connector: aws operations: [rds:Delete*] approver_group: On-call SRE ``` ## Troubleshooting Your workspace has the agent's policy tool turned off. Ask a workspace admin. You can still write Rules in the form. You need the workspace Admin role, or the Rule overlaps **Always blocked**. A Rule that changed after you opened it needs a new review: reload it, then accept. Check the mode. **Manual** asks before every write, also one that a Rule allows. Then check **Runs from** and **Connections**: a Rule matches only the run types and connections it names. ## Next steps Decide what happens to a write that no Rule covers Choose who answers an Ask first Rule and check what Rules decided This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.