Use case
Governed Approval Workflows
Require informed review for risky infrastructure changes, combining diffs, policy results, and approval routing.
Approval workflows are not a checkbox. They’re a control surface for risk management.
If the approver can’t see the diff context and governance signals, approvals become ceremonial—and incidents still happen.
The approval gate pattern
A safe approval gate ties together:
- The exact infrastructure diff (what will change).
- The policy evaluation result (what guardrails were triggered).
- The reason for the decision (what risk level the approver accepted).
- The approval routing (who can approve which risk).
Typical workflow
- Generate a plan (or remediation plan) for a target environment.
- Run policy evaluation and classify results (blocking vs warning).
- Request approval from the right approver or pool.
- Record the approver’s decision with context.
- Execute the governed reconciliation only after approval.
OrchesTerra connection
OrchesTerra surfaces approval-ready context and connects approvals to governed reconciliation so the final apply corresponds to the reviewed plan.
Related pages:
FAQ
Do approvals slow teams down?
Not when you gate only the changes that are genuinely risky. Classification reduces approval volume and focus.
Who should be approver?
Approvers should have ownership and competence for the categories of risk being changed (network, IAM, data, and shared services).