Approve prepared steps

An execution policy can require approvals before a prepared step runs. There is no mandatory approval policy installed by default. An administrator configures requirements separately from workflow YAML.

Review and approve

pyplines run info 42
pyplines run approve 42 --step restart

Replace the Run ID and step name with the pending work. The CLI shows the current Run and asks for confirmation. Review the target Environment, pinned Action, available prepared inputs, and intended external effect before approving. Protected values are not exposed through ordinary reads.

An Operator or Admin needs the appropriate access, and the policy must allow the approval. Permission to start a Run alone is insufficient. If allow_self is false, the person who started the Run cannot supply an eligible self-approval.

What approval binds to

Approval evidence covers the prepared inputs, pinned image, Environment revision, secret versions, and policy requirements. Changes to relevant input, context, secret, or policy state invalidate prepared evidence and may require new approvals.

Approval applies to a prepared step, not every future step or retry of a workflow. Inspect the current state again when an approval appears to have been invalidated; do not assume an earlier approval authorizes changed work.

Combine policies

Policies can apply to one Environment or appliance-wide using environment: '*'. Matching policies combine using the highest approval count and the intersection of permissions. An Environment policy cannot weaken an appliance-wide requirement.

See access and policy configuration for administrator examples. A rejected approval may reflect either missing API authorization or an unmet execution policy; these are separate checks.