--- title: "Approval request types" description: "Review the requests handled in Approvals, including work sessions, held commands, sudo, tokens, and accounts. See what approvers can inspect for each type." --- > Full documentation index: https://docs.alpacax.com/llms.txt # Approval request types # Approval request types Different requests route through [Approvals](/use/approvals/), and the review experience varies by type. For some types the reviewer can adjust the request before approving; others are review-only (approve or reject as-is). ## Work session A request for a new [work session](/use/work-sessions/). The reviewer sees the requested duration, features, target servers, and the requester's justification. Before approving a work session in the console, you can: - **Servers**: remove requested servers. - **Connect as**: narrow the run-as account when the request names one and the session is not assigned to a token. - **Access**: remove requested features. - **Session length** (or **Scheduled** for a scheduled session): shorten the duration or bring the end time forward. - **Recommendations**: add recommendations for the assignee. You cannot add servers or features, widen the account, or lengthen the window. Work sessions also include an [AI pre-review](/use/approvals/reviewing/#ai-pre-review). Approving sends along any adjustments you made. The queue shows a time-left meter to the decision deadline for every pending request, including immediate work sessions. The row turns to a warning when 30 minutes or less remain. In the decision panel, notices appear when a scheduled start is within 60 minutes, when that start has passed, or when the request will expire within 30 minutes if nobody decides. All three notices use the same warning tone. A work session whose requested end has passed cannot be approved (`work_session_expired`). An automatic cleanup cancels these pending sessions; a refused approval does not itself cancel them. See [urgency warnings](/use/approvals/reviewing/#urgency-warnings). ## Work session modification A request to change an existing session's servers or features. The reviewer sees the before/after **changes** and approves or rejects them. Review-only. ## Session extension A request to extend an existing session's end time, labeled **Session extension** in the queue—distinct from a work session modification. The reviewer sees the requester's reason, the session's current end time, the requested new end time, and the extension length. **Adjustable before approving.** The reviewer can leave the requested end time as-is, or shorten it—never set it later than what was requested. The chosen time is checked against the workspace's maximum session duration at the moment of approval. Rejecting leaves the session's end time unchanged. See [Extending with approval](/use/work-sessions/detail/#extending-with-approval) for the requester's side. ## Command approval A command that your [access rules](/use/approvals/#access-rules) hold before it runs, labeled **Command approval** in the queue. The reviewer sees the server and the whole command line, or the script file when the command runs one, with the command's risk level. Review-only. Approving lets the held command run, and also covers the `sudo` written in that line; rejecting refuses it. See [Held commands that run sudo](/use/approvals/reviewing/#held-commands-that-run-sudo). ## Sudo A `sudo` command that waits for a person before it runs, labeled **Sudo** in the queue. The reviewer sees the command, the server, the account it runs as, and its risk level. Review-only. Approving lets that command run once; rejecting refuses it. See [sudo with MFA](/use/work-sessions/terminal/sudo-with-mfa/#waiting-for-approval) for what the requester sees. ## Sudo policy A request to create a standing sudo policy, labeled **Sudo policy** in the queue. The reviewer sees the commands, servers, and people the policy covers, its validity window, and the reason. Review-only, and decided in the console with MFA; see [When a decision asks for MFA](/use/approvals/reviewing/#when-a-decision-asks-for-mfa). ## Service token A request to issue a [service token](/use/iam/applications/service-tokens/) for an application. The reviewer sees the requested scopes, the **risk** level with a per-scope breakdown, and the reason. Review-only (approve or reject). ## Token modification A request to change a service token (for example, enabling it or changing scopes). The reviewer sees the **changes**. Review-only. ## API token scope expansion A request to add scopes to an existing [API token](/use/settings/api-tokens/), labeled **API token scope expansion** in the queue. Narrowing a token's scopes applies at once and needs no request. Review-only, and decided in the console with MFA. ## Accept discovered account A request to settle an account Alpacon found on a server that isn't linked to anyone yet, labeled **Accept discovered account** in the queue: link it to a member or an application, link it to a different one, or refuse it. Review-only, and decided in the console with MFA. ## Username A request to set a username that requires approval. The reviewer sees the requested identity. Review-only. ## Group name A request to set a group name that requires approval. The reviewer sees the requested name. Review-only. ## Application account name A request to set an [application's](/use/iam/applications/provisioning/) server username to a name that already exists as an account or group on a server, labeled **Application account name** in the queue. The reviewer sees the requested name. Review-only. ## Summary | Type | Reviewer can adjust? | Has AI pre-review | | --- | --- | --- | | Work session | Yes: remove features or servers, narrow the account, shorten the window, add recommendations | Yes | | Work session modification | No | No | | Session extension | Yes: a shorter end time (never longer) | No | | Command approval | No | No (the command's risk level) | | Sudo | No | No (the command's risk level) | | Sudo policy | No | No | | Service token | No | No (risk from scopes) | | Token modification | No | No | | API token scope expansion | No | No | | Accept discovered account | No | No | | Username | No | No | | Group name | No | No | | Application account name | No | No | ## Related docs - [Reviewing requests](/use/approvals/reviewing/) - [Approvals overview](/use/approvals/) - [Work sessions](/use/work-sessions/) - [Service tokens](/use/iam/applications/service-tokens/) Source: https://docs.alpacax.com/reference/approvals/