What is held
- Destructive actions are held for approval by default, even when no approval policy matches.
- A write action runs unless an approval policy matches it. Add a policy, scoped to hosts by label, for the writes that matter.
- Raw commands are off unless you enable them, and every raw call waits for approval.
What you see
The approver sees the tool, the target host and the arguments, and may edit the arguments before approving. The agent waits, then retries the same call with the approval id once a team admin approves.
What an approval cannot be used for
An approval is single-use. It is bound to the same caller, server, tool and arguments, so it cannot be replayed for another host or another value. The agent that made the call cannot approve it.
Scope it before you approve anything
Approvals sit on top of the menu. The remediation agent only sees the actions its policy lists, on the hosts its labels reach, with the argument values you allow. For example: svc_restart for units nginx and php-fpm, on hosts labelled web, held for approval.
Stop an agent in one step
Every agent gets its own key. One switch disables an agent and its keys. A paused or killed agent cannot list or call tools.
The record
Every decision (allowed, held, approved, refused) goes into a keyed, hash-chained audit log that you can verify offline with your key.