# Recommendation approval policies

> Require approval before a recommendation is fixed or marked resolved. Choose which recommendations need it, who approves, how many approvals are needed, and how long each step can take.

Source: https://zop.dev/docs/zopnight/policies/approvals

---

A **recommendation approval policy** adds a sign-off step before change. When someone tries to **remediate** a recommendation the policy covers, or **mark it resolved**, ZopNight asks the right people to approve it first. Nothing runs until they do.

![Recommendation approval policies list with an Action filter, and policies showing their action, approvers, request and approval expiry, and an on/off status switch](https://storage.googleapis.com/zopdev-blog-resources/1/files/originals/20261020/ee6a74bd-689c-46ea-998e-e03003d014bf-policiesapprovals.png)

*Governance → Policies → Recommendation Approvals: each policy with its approvers, deadlines, and status.*

You set up policies at **Governance → Policies → Recommendation Approvals**. Approvers answer requests at **Activity → Approvals**.

## Before you start

- **Only Admins can create or change approval policies.** You need the built-in **Admin** role, given to you directly or through a team. Editors and custom roles can't change them.
- **To send a request**, you need permission to remediate recommendations. Anyone who can view recommendations can see whether one is waiting for approval.
- **Approvers** must be allowed to remediate recommendations across your **whole organisation**, through a role given to them directly or through a team. People whose role covers only some resources can't be approvers.

## What needs approval

For the recommendations a policy covers:

| Action | Needs approval? |
|---|---|
| **Remediate** a recommendation ZopNight can fix for you | Yes |
| **Mark resolved** on a recommendation you fix yourself (manual rules and [custom recommendations](https://zop.dev/docs/zopnight/policies/custom-recommendations)) | Yes |
| Creating a schedule from a schedule recommendation (**Review & remediate**) | Yes |
| Dismiss or snooze | No |
| Status changes that come from a linked Jira ticket | No |
| Creating a schedule on the Schedules page or with an AI assistant | No |

When an action needs approval, its button changes to **Send for approval**. Once the request is approved, you run the action as usual. Each approval can be used once.

## Create an approval policy

**Open the approval policies**

  Go to **Governance → Policies**, click the **Recommendation Approvals** card, then click **+ New policy**.

**Name it**

  A **Name** (required, for example "Production remediations") and, if you like, a **Description**.

**Choose what it covers**

  Pick the recommendations that need approval. Narrow the list with the **Kind** filter (Remediable, Manual, Custom; pick none to see everything), the **Providers**, **Resource types**, and **Categories** filters, or search. You can pick single rules, whole categories, or your custom recommendation policies. Pick at least one.

  Two turned-on policies can't cover the same recommendation. If yours overlaps another, saving fails and tells you which one.

**Choose who approves**

  Under **Approvers**, search by name, email, or role. Pick people, or pick a role (shown as **Role: name** with how many people are in it) to include everyone in it. You can choose up to 50.

  Need someone who isn't in ZopNight yet? Click **Invite** to add up to 10 people at a time, with a role you choose. They join your organisation **straight away** and get an email, even if you never save the policy. Your organisation can send up to 20 invites an hour.

**Choose how many approvals are needed**

  Under **Required approvals**:

  - **Any approver** (the default): one approval is enough.
  - **All approvers**: everyone must approve.
  - **Minimum number**: at least a set number of approvers.

  Nobody can approve their own request, so a minimum must be smaller than the number of approvers. To need everyone, choose **All approvers**.

**Decide whether Admins can skip approval**

  **Admins can run it without approval** is off by default, so Admins send for approval like everyone else. Turn it on and an Admin's change runs straight away; it's recorded, and the approvers are told. Even with it off, if an Admin is the only person who could approve, their change runs straight away.

**Set the deadlines**

  Each can be set in hours, days, or months, or to **Never**:

  | Setting | What it means | Default |
  |---|---|---|
  | **Request expires after** | How long approvers have to answer | 7 days |
  | **Approval expires after** | How long an approved change can still be run | 7 days |
  | **Remind approvers every** | How often approvers who haven't answered get a reminder email. Must be shorter than the request expiry. | 2 days |

**Save**

  Click **Create policy**. It applies to new requests straight away.

## How a request works

**Someone asks for approval**

  On the recommendation, they click **Send for approval**. The approvers get an email.

**Approvers decide**

  In **Activity → Approvals**, or with **Review request** on the recommendation, each approver chooses **Approve**, **Reject** (a reason is required), or **Request changes** (saying what to change). Anyone involved can also leave a **Comment**. Approvers who haven't answered get reminder emails.

**The requester follows up**

  If changes are requested, the requester updates the request and sends it again. They can also withdraw it, or add other people to give an opinion. Those people can comment and vote, but only the policy's approvers decide.

**The change runs**

  Once enough people approve, the requester runs **Remediate** or **Mark resolved** before the approval expires. Only the person who asked can use the approval.

A request shows one of these statuses:

| Status | What it means |
|---|---|
| **Waiting for approval** | Sent, not decided yet. |
| **Changes requested** | An approver asked for changes. It expires if it isn't sent again in time. |
| **Approved** | Ready to run, until the approval expires. |
| **Running** / **Applied** | The change is running, or done. |
| **Rejected** | An approver said no. The recommendation stays open, and it can be sent again. |
| **Expired · no decision** | Nobody answered in time, or too few approvers are left to reach the number needed. |
| **Approval lapsed** | It was approved, but not run before the approval expired. |
| **Withdrawn** | The requester took it back. |
| **Cancelled** | An Admin ended it. |
| **Closed** | ZopNight ended it, for example because the policy changed or the recommendation went away. |

Each recommendation has at most one open request at a time. If someone else already sent it, you'll see **Requested by someone else**, and only they can run it or send it again.

## Where people see requests

- **Activity → Approvals** lists requests under **Waiting on me**, **My requests**, and **All**, with a status filter. Admins see every request under **All**; everyone else sees the ones they sent or were asked to approve.
- **The notification bell** shows requests waiting on you, and how your own requests ended.
- **Email** goes to the approvers and the requester at each step: sent, decided, commented, reminded, and expired. These emails can't be turned off.
- **Chat channels** (Slack, Microsoft Teams, Google Chat) get a message for each request if they're subscribed to **Approval requested** or **Approval decided** under **Settings → Notifications**. Reminders are sent by email only.

Every step is also recorded in the audit log.

## When no policy covers a recommendation

If no turned-on policy covers a recommendation, what happens depends on the person:

- **People who can remediate across the whole organisation** go ahead without approval. While your organisation has no approval policy, ZopNight first asks them **Require approval for remediation?** They can create a policy (Admins only), or click **Self approve** to go ahead. Self approve hides the question for that rule, for everyone in your organisation, for 7 days. It doesn't create a policy.
- **People whose remediate permission covers only some resources** still need approval. They click **Send for approval** and choose which Admins to ask. A built-in default applies: any one of those Admins can approve, approvers have 7 days to answer, the approval can be used for 7 days, and reminders go out every 2 days.

## Change, turn off, or delete a policy

- **Changing the terms** (the approvers, the number of approvals needed, or either expiry) first asks **Close open requests?** Open requests under the old terms are closed, and their requesters and approvers are told. Requesters then send them again under the new terms.
- **Changing only the reminder interval or the Admin switch** leaves open requests as they are.
- **Turning a policy off or deleting it** closes its open requests the same way. A turned-off policy isn't checked for overlaps until you turn it back on.