Approvals

Some actions need an admin to sign off before they happen — work sessions with sensitive scopes, sudo authorizations for privileged commands, certain certificate operations. Every one of those requests leaves a record that captures what was asked, who reviewed it, the outcome, and the timing.

The Approvals page is where you review those records after the fact. It’s part of the Governance group, so the page is administrator-only.

How to get here

Open the sidebar and go to Audit → Governance → Approval history. Only administrators see this group.

What’s in the list

Each row is one approval request. The Audit view shows decisions that have already been made.

Type — what was requested: a work session, a sudo authorization, a certificate operation, and so on.
Requester — the IAM user who asked.
Reviewer — the admin who decided. Empty for requests that resolved automatically (for example, when a policy matched and no human review was needed).
Status — the outcome: approved, rejected, expired, or cancelled.
Decided at — when the decision was recorded.
Justification or notes — any text the requester or reviewer attached.

Click a row to open the full decision record, including the original request and any inline review notes.

Filtering

The Audit view reuses the same approvals UI as Pending approvals (under Execution), but pre-filtered to decisions that are already settled. You can narrow further by:

Status — show only one outcome (for example, only rejections).
Type — filter by request kind.
Date range — bound the audit to a window.

Access

This page is part of Governance, which only renders for administrators (staff, superuser, or RBAC admin / superuser roles). Non-admins who open the URL directly land on an access-denied page.

If you want someone to be able to review approval history but not approve new requests, that’s a separate role-permission decision — the page itself follows the same admin gate as the rest of Governance.

Questions this page answers

“Why was this work session approved?” → search by requester or session, open the row, read the reviewer’s note.
“How many requests does this reviewer process per week?” → filter by reviewer and date range.
“What’s our approval-vs-rejection rate for sudo this quarter?” → filter by type and date range, then look at the status distribution.
“Did anyone approve a request without a justification?” → look for approved rows with empty justification.

Pending approvals (Execution sidebar) is the operational view — the queue of decisions an admin still has to make. This page is the audit view of decisions already made.
Sudo — approval-type sudo authorizations link back to the matching decision here. Use Approvals to read the reviewer’s reasoning.
Sessions — work sessions that needed approval link to the matching decision here.