# How to Approve Destructive Remediations Safely: Step by Step

> How to Approve Destructive Remediations Safely. A practical walkthrough with ZopNight: read-only setup, production excluded by default, reversible at every step.

Source: https://zop.dev/learn/how-to/approve-destructive-remediations
Published: 2026-07-01 · Author: avinash-gaurav · Tags: zopnight, how-to, learn

---

Use the ZopNight approval workflow to gate destructive remediations. Configure approver groups, required justification, and audit log review.

This is the practical version, the one you can follow in a single sitting. It starts read-only, touches no production resource by default, and every step is reversible, so there is no point at which you are committed to something you cannot undo. Budget about 30 minutes. Before you start you will want: Org admin or security admin role to configure approver groups; Auto-remediation enabled at the organization level; A ZopNight account.

## The steps

1. Configure approver groups.
2. Require justification on destructive rules.
3. Review the precondition snapshot.
4. Approve and watch execution.
5. Handle failures.
6. Audit on a schedule.

## Why this is safe to do today

The reason this is a low-stakes change is that nothing here is destructive. Scheduling stops and starts resources; it never deletes them, and your data persists across a stop exactly as it does across a normal reboot. Production is excluded by default, actions run in dependency order, and every state change is logged with what triggered it.

If you want the fuller context behind this task, the [FinOps](https://zop.dev/learn/finops) guide covers where it fits, and the [AWS EC2 scheduling](https://zop.dev/zopnight/aws/ec2) page shows the same loop applied to a specific resource.

## Getting started

Getting started is intentionally low-stakes:

- Connect your cloud provider with a read-only role. Nothing is scheduled or changed at this stage.
- Let ZopNight discover your non-production resources and review exactly what it found, filtered by account, region, and status.
- Create a schedule in your timezone and attach the non-production resources or groups you want it to cover.
- Watch the first cycle run, with Slack, Teams, or Google Chat notifications on every start, stop, and failure, then layer in idle cleanup and guided rightsizing.

Production stays excluded by default throughout, and because discovery and recommendations are read-only, you can prove the value before you enable a single action.

## Frequently asked questions

### Can I require multiple approvers?

Yes. Approver groups can be configured to require N-of-M approvals before a remediation runs. This is appropriate for high-blast-radius rules.

### Is the approval workflow available for all rules?

The approval workflow is available for all certified rules and can be required as the default. Auto-execute is opt-in per rule.