The CAB
The Change Advisory Board (CAB) decides together on the changes an approval policy sends to it. The desk keeps the meeting: the agenda fills itself, each decision goes on the change it is about (and approves or rejects it), agreed actions become tasks, and the chair locks the minutes when the meeting is over.
Who can use it
Needs the Change Management plugin. In the sidebar: Change Management → CAB.
| Who | Can |
|---|---|
| Agent, Viewer, Auditor, Change Approver, Change Manager | See the CAB meetings of the organizations where they may read changes (change.read). |
| Change Manager | Plan and chair them (change.manage). |
| Administrator | Everything. |
With the plugin off, the meetings are hidden and kept.
Plan → Agenda → Notes, decisions and actions → Close and lock → Minutes
Planning a CAB
Plan a CAB asks for when, a title, where (a room or a call link) and the attendees. You chair it; the chair can be changed later.
The agenda
The agenda fills itself from what needs attention since the last CAB (or the last 30 days, for the first one):
| On the agenda | Why |
|---|---|
| Changes waiting for the CAB now | A policy's CAB stage asks for its decision. |
| Changes that failed since the last CAB | To learn from them. |
| Emergency changes since the last CAB | Reviewed afterwards. |
| Standard change templates due for their review within 30 days | They are approved for a period. |
| Open actions from earlier CABs | They come back until they are done. |
While the CAB is planned:
- Refresh agenda adds what has come up since; what is on the agenda stays.
- Add item puts a change on the agenda: search by its key (
CHG-40) or words in its title. - The chair can take an item without a decision off the agenda.
Items you can't see, such as a change on another unit's service, show as An item you can't see, without their title.
In the meeting
For each change:
| Part | Who and how |
|---|---|
| Notes | Any attendee keeps them. |
| Decision | The chair records it. Once recorded it is final, and it goes on the change's timeline. |
| Actions | A title, who and a due date. An action becomes a task on the change, and the person it is for is told. |
The decisions:
| Decision | Means |
|---|---|
| Approved | The CAB approves the change. |
| Rejected | Say why. The change is rejected. |
| Deferred | Say until when, or what is needed first. |
| Noted | Seen, nothing to decide. |
On a change waiting for the CAB, Approved or Rejected is the CAB's decision on the change's current stage. The approval records the chair and the attendees as the approvers then, and links to the meeting.
[!NOTE] Separation of duties applies: whoever asked for the change can't record the CAB's approval of it, unless the change settings allow requesters to approve.
A standard change template can only get Noted or Deferred here: it is approved on the Templates page.
Closing and the minutes
Close and lock (the chair):
- writes the minutes out as Markdown: the meeting, who attended, and each change with its notes, decision and actions;
- locks them with a SHA-256 checksum;
- emails them to the attendees (the CAB minutes notification, which each person can turn off under Settings → Notifications).
[!WARNING] Nothing on the meeting changes after that.
Minutes downloads them: as locked once closed, or as a draft while the meeting is planned. Each download is in the audit log.
For AI assistants and the API
| Way | What |
|---|---|
| AI assistants | list_cab_meetings and get_cab_meeting (changes:read). They read meetings; planning and deciding stays with people. |
| REST | Service Configuration keeps the meetings, under /api/v1/x/itsm/meetings (itsm:read, and itsm:write to change); see building a plugin. |
| Webhooks | changes.cab_closed when a meeting is closed, with the minutes' checksum. |