> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# Manage Approval Rules

This article explains how to create, edit, and delete action approval rules.
Rules define which actions require approval, who can approve them, and how long approvers and requesters have to respond.

For an overview of action approvals and how rules combine, see [About Action Approvals][about].

[about]: /data-protection/account-administration/access-management/action-approvals/about-action-approvals

## Create an approval rule

You can create rules from the

Action Approvals page

in the global management console.

### Before you start

* Make sure the SAML groups you want to use for approvers exist and have a role that includes the **Approve or deny approval requests** permission.
  The group list shows only groups that meet this requirement.
  To set up groups and permissions, see [About SAML SSO][saml] and [Manage Custom Roles][roles].

[saml]: /data-protection/account-administration/access-management/saml-sso/about-saml-sso

[roles]: /data-protection/account-administration/access-management/roles-and-permissions/manage-custom-roles

#### Choose the action

Select the action that the rule applies to.
For the list of eligible actions, see [Eligible actions][eligible].

[eligible]: /data-protection/account-administration/access-management/action-approvals/about-action-approvals#eligible-actions

#### Set the scope

Choose whether the rule applies to:

* **All items** of the selected action type.

* **A filtered or selected subset**, if applicable.
  The available options change depending on the entity type being protected by the rule.

#### Set the approvers

Configure who can approve and how many are required:

* **Number of approvers**: How many people must approve before the requester can apply the action.

* **SAML groups**: The SAML groups that approvers must come from.
  Leave this empty to allow any user with the **Approve or deny approval requests** permission to approve, regardless of group.
  Select a group to restrict approvers to the group.

A requester can't approve their own action request, even if they belong to a selected group.

#### Set the time period

Set the time period for the rule.
The same time period applies to two phases of the request:

* How long approvers have to respond after a request is submitted.

* How long the requester has to apply the action after all required approvals are received.

If either window elapses before the corresponding action, the request expires.

#### Set API request behavior

Choose whether requests from [API credentials][api-creds] require approval for the rule:

* **Require approval**: API requests must go through the approval flow.

* **Skip approval**: API requests bypass this rule and don't require approval.

When an action matches multiple rules with different API request settings, approval is required if any of those rules requires approval for API requests.

> **Tip**
>
> For details on how an API user works with action approvals, see [Action Approvals (API flow)][api].

[api-creds]: /data-protection/account-administration/access-management/api-credentials/about-api-credentials

#### Add a description

Write a description that explains the rule's purpose.
The description is shown to requesters in the modal that appears when they attempt the action, and on the action request page.
A clear description helps approvers and requesters understand why the rule exists.

#### Review and save

Review the rule, then click **Create**.
The rule takes effect immediately and applies to new attempts of the selected action.

In-flight action requests aren't affected by changes to rules.
Each request locks in the rules that applied at the moment it was created.

## Edit a rule

To edit a rule, on the

Action Approvals page

, click the rule's name.
You can change the scope, number of approvers, SAML groups, time period, API request behavior, and description.

Edits apply to new action requests only.
Action requests already in flight continue to use the rule as it was when they were submitted.

## Delete a rule

To delete a rule, on the

Action Approvals page

, find the rule and select **Delete** from its menu.

After you delete a rule, the action no longer require approval under that rule, and the rule no longer applies to existing action requests.
If other rules still match the action, those rules continue to apply.

## See also

* [About Action Approvals](/data-protection/account-administration/access-management/action-approvals/about-action-approvals)

* [Manage Action Requests](/data-protection/account-administration/access-management/action-approvals/manage-action-requests-requesters)

* [Respond to Action Requests](/data-protection/account-administration/access-management/action-approvals/respond-to-action-requests-approvers)

* [Action Approvals in the API][api]

[api]: /api/using-the-api/action-approvals