Approval request types
Different requests route through Approvals, and the review experience varies by type. For some types the reviewer can adjust the request before approving; others are review-only (approve or reject as-is).
Work session
A request for a new work session. The reviewer sees the requested duration, features, target servers, and the requester’s justification.
Before approving a work session in the console, you can:
- Servers: remove requested servers.
- Connect as: narrow the run-as account when the request names one and the session is not assigned to a token.
- Access: remove requested features.
- Session length (or Scheduled for a scheduled session): shorten the duration or bring the end time forward.
- Recommendations: add recommendations for the assignee.
You cannot add servers or features, widen the account, or lengthen the window.
Work sessions also include an AI pre-review. Approving sends along any adjustments you made.
The queue shows a time-left meter to the decision deadline for every pending request, including immediate work sessions. The row turns to a warning when 30 minutes or less remain.
In the decision panel, notices appear when a scheduled start is within 60 minutes, when that start has passed, or when the request will expire within 30 minutes if nobody decides. All three notices use the same warning tone.
A work session whose requested end has passed cannot be approved (work_session_expired). An automatic cleanup cancels these pending sessions; a refused approval does not itself cancel them.
See urgency warnings.
Work session modification
A request to change an existing session’s servers or features. The reviewer sees the before/after changes and approves or rejects them. Review-only.
Session extension
A request to extend an existing session’s end time, labeled Session extension in the queue—distinct from a work session modification. The reviewer sees the requester’s reason, the session’s current end time, the requested new end time, and the extension length.
Adjustable before approving. The reviewer can leave the requested end time as-is, or shorten it—never set it later than what was requested. The chosen time is checked against the workspace’s maximum session duration at the moment of approval. Rejecting leaves the session’s end time unchanged.
See Extending with approval for the requester’s side.
Command approval
A command that your access rules hold before it runs, labeled Command approval in the queue. The reviewer sees the server and the whole command line, or the script file when the command runs one, with the command’s risk level. Review-only. Approving lets the held command run, and also covers the sudo written in that line; rejecting refuses it. See Held commands that run sudo.
Sudo
A sudo command that waits for a person before it runs, labeled Sudo in the queue. The reviewer sees the command, the server, the account it runs as, and its risk level. Review-only. Approving lets that command run once; rejecting refuses it. See sudo with MFA for what the requester sees.
Sudo policy
A request to create a standing sudo policy, labeled Sudo policy in the queue. The reviewer sees the commands, servers, and people the policy covers, its validity window, and the reason. Review-only, and decided in the console with MFA; see When a decision asks for MFA.
Service token
A request to issue a service token for an application. The reviewer sees the requested scopes, the risk level with a per-scope breakdown, and the reason. Review-only (approve or reject).
Token modification
A request to change a service token (for example, enabling it or changing scopes). The reviewer sees the changes. Review-only.
API token scope expansion
A request to add scopes to an existing API token, labeled API token scope expansion in the queue. Narrowing a token’s scopes applies at once and needs no request. Review-only, and decided in the console with MFA.
Accept discovered account
A request to settle an account Alpacon found on a server that isn’t linked to anyone yet, labeled Accept discovered account in the queue: link it to a member or an application, link it to a different one, or refuse it. Review-only, and decided in the console with MFA.
Username
A request to set a username that requires approval. The reviewer sees the requested identity. Review-only.
Group name
A request to set a group name that requires approval. The reviewer sees the requested name. Review-only.
Application account name
A request to set an application’s server username to a name that already exists as an account or group on a server, labeled Application account name in the queue. The reviewer sees the requested name. Review-only.
Summary
| Type | Reviewer can adjust? | Has AI pre-review |
|---|---|---|
| Work session | Yes: remove features or servers, narrow the account, shorten the window, add recommendations | Yes |
| Work session modification | No | No |
| Session extension | Yes: a shorter end time (never longer) | No |
| Command approval | No | No (the command’s risk level) |
| Sudo | No | No (the command’s risk level) |
| Sudo policy | No | No |
| Service token | No | No (risk from scopes) |
| Token modification | No | No |
| API token scope expansion | No | No |
| Accept discovered account | No | No |
| Username | No | No |
| Group name | No | No |
| Application account name | No | No |