Approval Workflows

Configure and operate human approval gates for sensitive Starfire AI workflow steps without turning a missing response into implicit authorization.

Approval workflows

Approval gates let automation prepare a sensitive action while keeping the final authorization with an approved human role.

Good approval candidates

Use an approval gate for actions such as:

• publishing or deploying an artifact
• destructive file changes
• high-cost actions beyond a configured threshold
• changes to important organization configuration
• sensitive external-service actions
• other consequential operations defined by policy

Approval lifecycle

Workflow reaches protected step
        ↓
Create approval request
        ↓
WAITING_FOR_APPROVAL
        ↓
Approved / Rejected / Expired / Cancelled
        ↓
Continue or stop

Approval request contents

A useful request tells the approver:

• what action will occur
• target resource
• why the workflow wants to do it
• expected impact
• cost/usage impact when relevant
• which run/workflow requested it

Approved

Approval allows that defined action to proceed under the current runtime permissions. It should not grant the workflow broader permanent permissions.

Rejected

The workflow should stop, skip, or follow an explicitly configured rejection path. It should not repeatedly recreate the same approval to pressure a different outcome.

Expired

No response is not approval. Expired requests need a defined workflow outcome.

Auditability

Important approval decisions should record the approver, decision, timestamp, target, and originating run when the active implementation supports it.

An approval system is strongest when the approver can see the real action and target. Avoid generic prompts such as “Allow agent to continue?” for high-impact operations.