Approvals put a human decision in front of any operation that must not happen silently — issuing production wildcards, revoking a live CA, deploying to a load-balancer VIP, or elevating a role. They integrate with Workflows so any workflow step can pause until approval, and with Alerts so overdue approvals escalate automatically.
Approvals

​
What it is

An approval request captures the target resource, the proposed change, and the list of required approvers. It sits in a pending state until the required number of approvers act on it. Approvers can review, add notes, approve, or reject. Every state change is written to the audit log with reviewer identity and timestamp.

​
When to use it

  • Require two approvers before issuing a wildcard certificate for a production domain.
  • Gate CA key rotation behind a security team approval.
  • Pause a workflow that deploys to a production load balancer until an SRE on-call confirms.
  • Require a security lead’s sign-off before revoking a live certificate.

​
Approval types

TypeTypical triggerTypical approvers
certificate_issueWildcards, long-validity certsSecurity lead
certificate_revokeAny revocationCA admin
ca_changeNew CA, key rotationSecurity team + CA admin
deploymentDeploy to production load balancer / gatewaySRE on-call
role_changeElevating a user’s roleWorkspace owner
policy_changeModifying an issuance policySecurity team

​
Set it up

1

Open the Approvals inbox

Go to Approvals (next to Alerts in the top navigation). You’ll see all requests where you are an eligible approver.
2

Create a manual approval (optional)

Click New approval request, choose the type, select the target resource, add a reason, and specify the approvers. For automatic approvals triggered by workflows, this step is handled by the workflow configuration.
3

Review and decide

Click any pending approval to see the requested change. Click Approve or Reject and add notes. Notes are required for rejections and recommended for approvals.

​
What you’ll see

Approved requests unblock the waiting workflow or operation immediately. Rejected requests record the rejection reason and notify the requester. The Approvals list shows status (pending, approved, rejected), requester, approvers, and the resource that was approved.
Self-approval is not allowed. The person who created the approval request cannot appear in the approvers list for that same request.

​
Escalation

Each approval can carry an escalation configuration: after a set number of minutes with no decision, TigerTrust re-notifies a second tier of approvers and, optionally, raises a high severity alert. Configure escalation tiers at Settings > Approval policies.
Approvals do not grant the requester elevated permissions. Once approved, the original operation runs under the requester’s identity but with the approval receipt attached — the audit log records both who asked and who allowed.

​
Tips

  • For high-volume, low-risk approval types (such as standard TLS deployments), enable bulk approve in the approval policy so on-call engineers can clear a queue in one action.
  • Multi-approval (N-of-M) prevents a single administrator from unilaterally pushing a production change.

Workflows

Insert an approval step into any workflow.

Audit logs

Every approval decision with reviewer, time, and notes.

Notifications

Route pending-approval notices to the right channels.