About Action Approvals
Action approvals add an authorization layer on top of permissions. With action approvals, you require designated people to approve specific actions before they execute, so high-impact changes can’t be made by a single person acting alone.
Action approvals are useful when:
-
An action is hard or impossible to reverse, such as deleting a backup policy.
-
Compliance or internal policy requires that more than one person authorize specific operations.
Approval requirements apply on top of role-based access control. A user must already have permission to perform the action. Without it, they can’t start the approval flow at all.
Personas
Action approvals involve two personas:
-
Requesters: Users who start an action that requires approval. The action is queued as an action request, and the requester returns to apply it once it’s approved.
-
Approvers: Users who approve or deny pending action requests. Approvers don’t need permission to perform the requested action themselves. They only need permission to approve.
A user can be both a requester and an approver in different rules, but a requester can’t approve their own action request, even if they’re in an approver group for that rule.
The action request lifecycle
When someone attempts an action covered by an approval rule, Eon intercepts the attempt and allows the requester to submit an action request. An action request moves through a series of states as approvers respond, time passes, and the requester applies the approved action, as shown in this diagram and described below:
Apply the approved action
When an action request is created, if its approval requirements are fulfilled before the request expires, the action is returned to the requester. The requester can then apply the action within the post-approval time period.
Denial or cancellation
Any approver can block an action by denying the action request at any time before it’s applied. This can be done up until the approval requirements are fulfilled.
The requester can cancel a request at any time.
Expiration
An action request must meet its approval requirements within a set time period, and then the requester must apply it within a set post-approval time period. If either of the time periods run out before the action is applied, the action request expires.
Approval rules
Approval rules define which actions require approval and who can approve them. A rule includes:
-
Action: The type of action that triggers approval, such as deleting a backup policy or restoring a resource. For the full list, see Eligible actions.
-
Scope: Whether the rule applies to all items of that action type, or to a filtered subset. The condition builder is the same one used by backup policies, so you can target rules to specific backup policies, resources, or other properties.
-
Number of approvers: How many people must approve before the requester can apply the action. One or more.
-
SAML groups: The SAML groups from which approvers must come. The list shows only groups whose role includes the Approve or deny approval requests permission. If you don’t select any group, approvals can come from any user with the approve permission.
-
Time period: How long approvers have to respond, and how long the requester has to apply the action after it’s approved.
-
API requests: Whether requests from API credentials require approval or skip approval for this rule. By default, API requests require approval.
-
Description: Text shown to requesters in the interception modal and on the request page, explaining why the rule exists.
For step-by-step configuration, see Manage Approval Rules.
How multiple rules combine
A single action can match more than one approval rule. When that happens, Eon enforces every applicable rule, not just one:
Eon doesn’t prevent you from creating overlapping rules, but the cumulative requirements can become strict quickly. Review your rules together to make sure the combined requirements still match your intent.
Permissions
Action approvals use two permissions at different points in the flow:
-
The action’s own permission: A requester must already have permission to perform the underlying action. For example, a user needs permission to delete a backup policy before they can submit a deletion as an action request.
-
Approve or deny approval requests: An approver needs this permission to approve or deny pending action requests. Approvers don’t need the underlying action’s permission. The rule restricts who can approve, while the underlying permission restricts who can request.
Notifications
Action approvals send email notifications about request lifecycle events.
For requesters: Eon automatically notifies a requester about the lifecycle of their own action requests. No configuration is needed. Notifications cover the full lifecycle, including approval, denial, expiration, and when the action is applied.
For approvers: Approvers don’t automatically receive notifications when a request needs their attention. To get notified, set up a notification policy for the action approval events you care about. You can route these notifications to email, Slack, or other configured channels. For setup steps, see About Notification Policies.
Approver notifications go to every member of the configured channel, regardless of whether they’re listed as a possible approver for a specific request.
The available action approval events are:
-
Action request pending approval.
-
Action request partially approved (some required approvers have approved, but not all).
-
Action request approved.
-
Action request denied.
-
Action request applied.
-
Action request expired.
-
Action request canceled.
Eligible actions
These actions can be placed under approval rules: