Skip to content
TruthVouch Docs

Multi-Stakeholder Approvals

Overview

Require approval from security, compliance, or other teams before policies go live. This ensures multiple eyes review governance changes.

Setup Approval Requirements

  1. Go to Settings → Governance → Approval Settings
  2. Require Approval For: Select what needs approval
    • Policy creation
    • Policy modifications
    • Policy deployment
    • Firewall configuration changes
  3. Approvers: Select users or roles who can approve
  4. Number of Approvals Required: 1, 2, or 3
  5. Auto-Approve Timeout: Auto-approve if not responded in X days (optional)
  6. Click Save

Approval Workflow

Step 1: Create Policy

  1. Policy Creator writes and tests policy
  2. All tests pass
  3. Click Request Approval (instead of Deploy)

Step 2: Approval Notification

  1. Approvers Notified:
    • Email: “Policy ‘Block PII’ requires your approval”
    • Slack: Message in #security channel
    • In-app: Notification badge
  2. Approval Link: Click to review

Step 3: Review

  1. Approver reviews policy:
    • Purpose and description
    • Test cases and results
    • Impact analysis
    • Version history
  2. Decides: Approve or reject

Step 4: Approve

If approved:

  1. Click Approve
  2. Optional: Add comment “Looks good, tested with production data”
  3. If multiple approvers required, others are notified
  4. Once all approvals received, Deploy button appears

Step 5: Deploy

  1. Policy Creator can now click Deploy
  2. Policy goes live
  3. Approval history tracked in audit trail

Rejection Workflow

If approver has concerns:

  1. Click Request Changes
  2. Add comment explaining issue:
    • “False positive rate too high”
    • “Need clarification on scope”
    • “Conflicts with existing policy”
  3. Policy Creator gets notification
  4. Revises policy
  5. Resubmits for approval

Role-Based Approval

Different roles require different approvers:

approval_workflows:
  policy_creation:
    requires_approval: true
    approvers_required: 2
    approvers: ["security_team", "engineering_lead"]


  policy_modification:
    requires_approval: true
    approvers_required: 1
    approvers: ["policy_author"]  # Original author reviews changes


  firewall_config_change:
    requires_approval: true
    approvers_required: 3
    approvers: ["cto", "security_lead", "compliance_officer"]


  rule_deployment:
    requires_approval: false  # Custom rules don't need approval

Approval Templates

Pre-define common approval requirements:

Template: Low-Risk Change

  • 1 approval required
  • From: Security team
  • Auto-approve after: 48 hours

Template: Medium-Risk Change

  • 2 approvals required
  • From: Security + Engineering
  • Auto-approve after: 72 hours

Template: High-Risk Change

  • 3 approvals required
  • From: CTO + Security + Compliance
  • No auto-approve

Managing Approvers

Add/Remove Approvers

  1. Go to Settings → Teams → Security
  2. Members: Add/remove users
  3. These users automatically become approvers

Designate Backup Approver

If primary approver unavailable:

  1. Approval Settings → Escalation
  2. If no approval in X days, escalate to backup
  3. Backup gets notification
  4. Backup can then approve/reject

Approval History

Track all approvals:

  1. Go to Governance → Policies → [Policy]
  2. Click History tab
  3. See timeline:
    • When policy created
    • When submitted for approval
    • Who reviewed and when
    • Approval/rejection comments
    • When deployed

Example:

Mar 13, 10:45 - John created "Block PII" policy
Mar 13, 11:00 - John submitted for approval
Mar 13, 11:30 - Sarah reviewed, requested changes
          Comment: "Test case 3 needs more detail"
Mar 13, 14:15 - John resubmitted with test case detail
Mar 13, 14:20 - Sarah approved
Mar 13, 15:00 - John deployed policy to production

Automatic Approvals

Auto-approve under certain conditions:

auto_approval:
  enabled: true


  rules:
    # Small changes auto-approve
    - if: "policy_lines_changed < 10"
      then: "auto_approve"


    # Low-risk policy types auto-approve
    - if: "policy_type == 'allowlist'"
      then: "auto_approve"


    # Revert to previous version auto-approves
    - if: "action == 'rollback'"
      then: "auto_approve"


    # After 72 hours, auto-approve
    - if: "time_pending > 72 hours"
      then: "auto_approve"

Approval SLA

Track approval turnaround:

SLA Targets:

  • Low-risk: Approval within 24 hours
  • Medium-risk: Approval within 48 hours
  • High-risk: Approval within 5 business days

Dashboard shows:

  • Average approval time
  • % of policies approved on time
  • Bottlenecks (approvers delaying)

API for Approvals

Integrate with external systems:

Terminal window
# List pending approvals
curl -X GET http://localhost:5000/api/v1/governance/approvals/pending \
  -H "Authorization: Bearer $TOKEN"


# Approve a policy
curl -X POST http://localhost:5000/api/v1/governance/approvals/123/approve \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"comment": "Approved"}'


# Reject a policy
curl -X POST http://localhost:5000/api/v1/governance/approvals/123/reject \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"comment": "Needs revision"}'