Recommendation approval policies

A recommendation approval policy adds a sign-off step before change. When someone tries to remediate a recommendation the policy covers, or mark it resolved, ZopNight asks the right people to approve it first. Nothing runs until they do.

Governance → Policies → Recommendation Approvals: each policy with its approvers, deadlines, and status.

You set up policies at Governance → Policies → Recommendation Approvals. Approvers answer requests at Activity → Approvals.

Before you start

• Only Admins can create or change approval policies. You need the built-in Admin role, given to you directly or through a team. Editors and custom roles can’t change them.
• To send a request, you need permission to remediate recommendations. Anyone who can view recommendations can see whether one is waiting for approval.
• Approvers must be allowed to remediate recommendations across your whole organisation, through a role given to them directly or through a team. People whose role covers only some resources can’t be approvers.

What needs approval

For the recommendations a policy covers:

Action	Needs approval?
Remediate a recommendation ZopNight can fix for you	Yes
Mark resolved on a recommendation you fix yourself (manual rules and custom recommendations)	Yes
Creating a schedule from a schedule recommendation (Review & remediate)	Yes
Dismiss or snooze	No
Status changes that come from a linked Jira ticket	No
Creating a schedule on the Schedules page or with an AI assistant	No

When an action needs approval, its button changes to Send for approval. Once the request is approved, you run the action as usual. Each approval can be used once.

Create an approval policy

1. Open the approval policies

   Go to Governance → Policies, click the Recommendation Approvals card, then click + New policy.

2. Name it

   A Name (required, for example “Production remediations”) and, if you like, a Description.

3. Choose what it covers

   Pick the recommendations that need approval. Narrow the list with the Kind filter (Remediable, Manual, Custom; pick none to see everything), the Providers, Resource types, and Categories filters, or search. You can pick single rules, whole categories, or your custom recommendation policies. Pick at least one.

   Two turned-on policies can’t cover the same recommendation. If yours overlaps another, saving fails and tells you which one.

4. Choose who approves

   Under Approvers, search by name, email, or role. Pick people, or pick a role (shown as Role: name with how many people are in it) to include everyone in it. You can choose up to 50.

   Need someone who isn’t in ZopNight yet? Click Invite to add up to 10 people at a time, with a role you choose. They join your organisation straight away and get an email, even if you never save the policy. Your organisation can send up to 20 invites an hour.

5. Choose how many approvals are needed

   Under Required approvals:

   • Any approver (the default): one approval is enough.
   • All approvers: everyone must approve.
   • Minimum number: at least a set number of approvers.

   Nobody can approve their own request, so a minimum must be smaller than the number of approvers. To need everyone, choose All approvers.

6. Decide whether Admins can skip approval

   Admins can run it without approval is off by default, so Admins send for approval like everyone else. Turn it on and an Admin’s change runs straight away; it’s recorded, and the approvers are told. Even with it off, if an Admin is the only person who could approve, their change runs straight away.

7. Set the deadlines

   Each can be set in hours, days, or months, or to Never:

   Setting	What it means	Default
   Request expires after	How long approvers have to answer	7 days
   Approval expires after	How long an approved change can still be run	7 days
   Remind approvers every	How often approvers who haven’t answered get a reminder email. Must be shorter than the request expiry.	2 days

8. Save

   Click Create policy. It applies to new requests straight away.

How a request works

1. Someone asks for approval

   On the recommendation, they click Send for approval. The approvers get an email.

2. Approvers decide

   In Activity → Approvals, or with Review request on the recommendation, each approver chooses Approve, Reject (a reason is required), or Request changes (saying what to change). Anyone involved can also leave a Comment. Approvers who haven’t answered get reminder emails.

3. The requester follows up

   If changes are requested, the requester updates the request and sends it again. They can also withdraw it, or add other people to give an opinion. Those people can comment and vote, but only the policy’s approvers decide.

4. The change runs

   Once enough people approve, the requester runs Remediate or Mark resolved before the approval expires. Only the person who asked can use the approval.

A request shows one of these statuses:

Status	What it means
Waiting for approval	Sent, not decided yet.
Changes requested	An approver asked for changes. It expires if it isn’t sent again in time.
Approved	Ready to run, until the approval expires.
Running / Applied	The change is running, or done.
Rejected	An approver said no. The recommendation stays open, and it can be sent again.
Expired · no decision	Nobody answered in time, or too few approvers are left to reach the number needed.
Approval lapsed	It was approved, but not run before the approval expired.
Withdrawn	The requester took it back.
Cancelled	An Admin ended it.
Closed	ZopNight ended it, for example because the policy changed or the recommendation went away.

Each recommendation has at most one open request at a time. If someone else already sent it, you’ll see Requested by someone else, and only they can run it or send it again.

Where people see requests

• Activity → Approvals lists requests under Waiting on me, My requests, and All, with a status filter. Admins see every request under All; everyone else sees the ones they sent or were asked to approve.
• The notification bell shows requests waiting on you, and how your own requests ended.
• Email goes to the approvers and the requester at each step: sent, decided, commented, reminded, and expired. These emails can’t be turned off.
• Chat channels (Slack, Microsoft Teams, Google Chat) get a message for each request if they’re subscribed to Approval requested or Approval decided under Settings → Notifications. Reminders are sent by email only.

Every step is also recorded in the audit log.

When no policy covers a recommendation

If no turned-on policy covers a recommendation, what happens depends on the person:

• People who can remediate across the whole organisation go ahead without approval. While your organisation has no approval policy, ZopNight first asks them Require approval for remediation? They can create a policy (Admins only), or click Self approve to go ahead. Self approve hides the question for that rule, for everyone in your organisation, for 7 days. It doesn’t create a policy.
• People whose remediate permission covers only some resources still need approval. They click Send for approval and choose which Admins to ask. A built-in default applies: any one of those Admins can approve, approvers have 7 days to answer, the approval can be used for 7 days, and reminders go out every 2 days.

Change, turn off, or delete a policy

• Changing the terms (the approvers, the number of approvals needed, or either expiry) first asks Close open requests? Open requests under the old terms are closed, and their requesters and approvers are told. Requesters then send them again under the new terms.
• Changing only the reminder interval or the Admin switch leaves open requests as they are.
• Turning a policy off or deleting it closes its open requests the same way. A turned-off policy isn’t checked for overlaps until you turn it back on.