Approval Lifecycle¶
Lifecycle¶
- Policy flags approval requirement.
- Approval request is formed with bounded scope and expiry.
- Authorized approver reviews contextual evidence.
- Approver records allow/deny decision and rationale.
- Runtime verifies approval validity before and during execution.
- Approval can be revoked or expire.
Approval Constraints¶
- Request-specific
- Scope-specific
- Target-specific
- Time-bound
- Attributable to accountable identity
Fail-Closed Behavior¶
If required approval is absent, expired, mismatched, or revoked, execution is denied or contained.
Diagram¶
Source: diagrams/../diagrams/approval-lifecycle.mmd
Related ADR: