Access Requests and Approval Workflows

Access request rule

A policy that requires explicit approval before commands run against a protected resource. Rules can be scoped per command, bound to specific resources, and limited to specific user groups.

By command approval

An enforcement mode where every individual command executed against a resource requires its own approval before it runs. Prevents unilateral access to production.

Resource binding

An access request rule only enforces on the resources explicitly attached to it. This is what scopes the policy to the systems that need protection.

Approval user groups

The groups whose members can approve incoming requests. Combined with an approval count to require single or multi-party approval.

Force approval groups

A break-glass mechanism that lets specific groups, typically SRE, bypass the standard approval flow during urgent scenarios.

Slack approval flow

Approvers receive request notifications directly in Slack with the requester's name, email, target connection, exact command, and group membership. One-click approve or deny without leaving Slack.

Audit trail

A locked record of every step in the request: who requested access, what command they ran, which system, when it happened, and who approved it. Designed as evidence for SOC 2 and ISO 27001 audits.