Skip to main content

Approve or Deny a Request

Tasks

Step-by-step instructions for deciding on a developer's pending request and for revoking a grant early. See Approval Workflow for how the underlying lifecycle works.

Decide on a single-approver request​

  1. Go to Security → Approvals. Pending requests are listed with the requester, request type, and justification.
  2. Open a request to see its full detail — for an exception request this includes the target policy; for a model-access request, the requested model; for a session budget top-up, the requested amount.
  3. Click Approve or Deny. Approving takes effect immediately — there is no separate "activate" step. Denying ends the request; the developer can submit a new one.
note

Approving or denying is final for a single-approver request — there's no undo. To end a grant you already approved, use Revoke a granted exception below.

Co-sign a multi-approver request​

Some requests require more than one approver (configured per-policy or per-request by an admin). These show an Under Review status with a checklist of required approvers and their decisions so far. The grant is created as soon as the request escalates to co-sign — Under Review means the grant is already active and being reviewed, not that it's on hold pending everyone's sign-off.

  1. Go to Security → Approvals and open a request showing Under Review.
  2. Review the approval chain — each required approver's name and whether they've decided yet.
  3. Click Approve or Deny to record your own decision. You can only record a decision for yourself — the system rejects an attempt to decide on someone else's behalf.

What happens next depends on the other approvers:

  • If you're the last required approver to approve, the request is marked approved and the requester is notified; the grant itself doesn't change (it's been active since escalation).
  • If any approver — you or someone else — denies, the request is denied immediately, even if other approvers haven't decided yet, and the already-active grant is revoked on the spot.
  • If approvers are still pending, the request stays Under Review. Nothing further happens until the quorum is reached.
tip

If two approvers act within moments of each other, AIControls resolves the race safely — the request completes exactly once (one final approval or one revoke) and the requester gets exactly one notification, never a duplicate.

Revoke a granted exception​

There's no dedicated admin UI page for browsing and revoking granted exceptions yet — the Security → Exceptions page manages exception policies (the reusable rules a request can be granted against), not the individual grants those requests produce. Revoke a live grant via the admin API instead:

  1. List currently active grants with GET /api/v1/policy-exceptions and find the id of the one you want to end — filter the response by developerId or policyName.
  2. Revoke it with DELETE /api/v1/policy-exceptions/{id}.

The exception is deactivated immediately on either call succeeding — the developer's next matching request is evaluated as if it had never been granted — and both the developer and your admin audience are notified.

note

Revoking is for ending a grant early. If you just want it to end on schedule, no action is needed — expiry is automatic and fires its own notification.

See also​

Last updated on