Skip to main content

Approvals as evidence

Some changes don't fit a change record: a one-off access request, a refund over a limit. Approvals on cases cover those. On a case, the Controls panel in the side column lists the controls that apply (met now or not, and what was recorded when the case was resolved) and the case's approvals (working on a case).

There are two ways to ask.

Ask for an approval… asks someone with the Approve cases permission (case.approve). They decide on the case. They can't be the case's assignee, nor whoever asked.

Ask the customer… sends the question to the requester as a reply:

Ask the customer… → Your approval is asked → Code by email → Approve or Reject → Decision kept
Code by email → New code needed: after 10 minutes or 5 tries
Decision kept → Approval void: the subject or the request changed afterwards
  1. On their case page (the link in their emails) they see Your approval is asked.
  2. They ask for a 6-digit code by email.
  3. They Approve or Reject (rejecting needs a comment).

A code is valid for 10 minutes and allows 5 tries; at most 5 codes are sent in 15 minutes.

[!IMPORTANT] A link alone never approves anything: whoever has the case page open must also read the requester's email.

Each decision keeps who decided, when, the comment, the address and browser, and the fingerprint: a SHA-256 of the case's subject and request fields as they were. Changing the subject or the request afterwards voids the approval: the panel says “the request changed after it was approved”, the control is no longer met, and you ask again. Asking again also voids the earlier answers.