Skip to main content

​
Overview

Approval enforcement runs on the server for dashboard, API, CLI, and service-account mutations. SDK evaluation uses only active configuration. A notification or supplied request ID never authorizes a write.

​
Policy matching

All project, environment, and team references must belong to the organization. Policies apply across dashboard, CLI, API, and service-account changes; they cannot be restricted to a particular client or last writer. Policies are frozen into requests. Editing, deleting, disabling, or adding any policy invalidates pending requests in the organization rather than changing the meaning of recorded votes.

​
Request lifecycle

There is at most one pending request per flag/environment pair. To revise intent, cancel and resubmit. Identical decision retries are idempotent; changing the comment or decision of an existing vote is a conflict. Terminal requests cannot be reopened. Review authorization is checked at decision time. Removed, banned, demoted, or otherwise ineligible users cannot review, and their earlier votes do not count toward application. Reviewer assignments form the durable inbox notification; repeated reads do not duplicate it. Approval emails are not sent.

​
Config and CLI outcomes

--force bypasses ordinary sync version conflicts only. It cannot bypass policy, immutable approval revisions, or review authorization. Non-interactive confirmation flags do not constitute approval. Mixed default-only pushes may apply some unprotected defaults and queue others; pushes with unsupported protected definition operations roll back entirely.

​
Audit evidence

Request creation, approvals, rejection, cancellation, expiration, policy invalidation, and application produce per-request audit events. Approved mutations also produce the linked flag.environment.updated event. Decision comments are included subject to audit redaction. Events and export deliveries commit with their mutation; duplicate decisions do not append duplicate events. Audit evidence remains subject to its retention policy after organization deletion. See Audit log for retention and deletion rules. Related: Review production changes.