Approvals Flow

This guide shows how an advise result turns into an approved change and a safe apply.

What gets approved

• A change set: a list of small, idempotent steps (e.g., scale memory for a service).
• Approval is required when risk guardrails or policy demand it (e.g., high impact, outside business hours).

Flow

Approver channels

• Webhook: configurable URL(s) with optional bearer/basic/API key and HMAC signature.
• Email: default or tenant-specific recipients; templated subjects.
• Chat: Google Chat via configurable webhook.

Configuration

• Tenant Admins set approver groups and notification channels.
• Platform Admin can tune timeouts and backoff via APPROVAL_WEBHOOK_* environment variables (see Reference → Environment Variables).

Audit & metrics

• Every approval and apply records an audit event (who, when, what, result).
• Metrics include counts and time-to-approve by risk band.