Manage Approval Rules

Who can use this feature

Anyone with these permissions: Manage action approval rules

This article explains how to create, edit, and delete action approval rules. Rules define which actions require approval, who can approve them, and how long approvers and requesters have to respond.

For an overview of action approvals and how rules combine, see About Action Approvals.

Create an approval rule

You can create rules from the Action Approvals page in the global management console.

Before you start

Make sure the SAML groups you want to use for approvers exist and have a role that includes the Approve or deny approval requests permission. The group list shows only groups that meet this requirement. To set up groups and permissions, see About SAML SSO and Manage Custom Roles.

Choose the action

Select the action that the rule applies to. For the list of eligible actions, see Eligible actions.

Set the scope

Choose whether the rule applies to:

All items of the selected action type.
A filtered or selected subset, if applicable. The available options change depending on the entity type being protected by the rule.

Set the approvers

Configure who can approve and how many are required:

Number of approvers: How many people must approve before the requester can apply the action.
SAML groups: The SAML groups that approvers must come from. Leave this empty to allow any user with the Approve or deny approval requests permission to approve, regardless of group. Select a group to restrict approvers to the group.

A requester can’t approve their own action request, even if they belong to a selected group.

Set the time period

Set the time period for the rule. The same time period applies to two phases of the request:

How long approvers have to respond after a request is submitted.
How long the requester has to apply the action after all required approvals are received.

If either window elapses before the corresponding action, the request expires.

Set API request behavior

Choose whether requests from API credentials require approval for the rule:

Require approval: API requests must go through the approval flow.
Skip approval: API requests bypass this rule and don’t require approval.

When an action matches multiple rules with different API request settings, approval is required if any of those rules requires approval for API requests.

For details on how an API user works with action approvals, see Action Approvals (API flow).

Add a description

Write a description that explains the rule’s purpose. The description is shown to requesters in the modal that appears when they attempt the action, and on the action request page. A clear description helps approvers and requesters understand why the rule exists.

Review and save

Review the rule, then click Create. The rule takes effect immediately and applies to new attempts of the selected action.

In-flight action requests aren’t affected by changes to rules. Each request locks in the rules that applied at the moment it was created.

Edit a rule

To edit a rule, on the Action Approvals page, click the rule’s name. You can change the scope, number of approvers, SAML groups, time period, API request behavior, and description.

Edits apply to new action requests only. Action requests already in flight continue to use the rule as it was when they were submitted.

Delete a rule

To delete a rule, on the Action Approvals page, find the rule and select Delete from its menu.

After you delete a rule, the action no longer require approval under that rule, and the rule no longer applies to existing action requests. If other rules still match the action, those rules continue to apply.