Data owners and approvers

Some policies ask for an approval instead of a flat no: a contractor reaching a design document outside their statement of work, or an agent reaching for a confidential plan that none of its person’s work needs. The request waits until someone else approves or rejects it.

Who approves

Whoever your policies allow to approve the resource. The base policies allow:

• the resource’s owner, as its own system records it, such as a document’s owner in Google Drive;
• the security team, for anything.

Your company can add more in policy, such as managers for their reports’ requests, or an overseer agent for routine, low-sensitivity requests. See Agents as approvers.

Nobody approves their own request, or one made for them by an agent.

Approving or rejecting

1. Find the request. It’s on the client portal’s Challenges page, under Waiting for your approval, which lists the requests you may approve. With Slack connected, owners get a direct message and the security team’s channel gets a post, each with a link that opens the request.
2. Look at what’s asked: who is asking, whether an agent is asking for them, the action, and the resource. A justification, if the request needed one, appears with it.
3. Decide, with a note:
   • Approve: the request is allowed for a short while once its other challenges are passed. The requester can retry.
   • Reject: the request stays denied for a day.

The person who asked is told your decision, and the decision is recorded with your name.

What to approve

Approve what the person needs for their work right now. Reject, or ask them first, when:

• the request doesn’t fit what they do, or what their team does;
• an agent is asking for something its person didn’t mention needing;
• it’s late at night, from an account that doesn’t usually work then, or the request is unusual in some other way.

If something looks wrong rather than just unnecessary, reject it and tell your security team. They can look at the principal’s activity, and contain them if needed.