Approval requests

In this tutorial, we let an organisation system, such as an ERP or a payments app, ask a person to approve one specific operation, with the exact values in view. In the console, open Manage, Third-party requests. If you don't see it, the service doesn't have this feature turned on yet. First, create an operation type: a key, such as invoice dot pay, the name the person sees, the maximum validity, and the fields, for example the amount and the payee.

Each save creates a revision. Choose whether approval can happen on the phone. The safest mode is the person typing on the phone the code the source system shows them. The compared code is only for when the person can't see the code, and it doesn't protect against fatigue approvals. Then create the machine client for the source system: the scopes, the allowed operation types and, optionally, a webhook.

The client secret is shown only once: hand it over through a secure channel. For the person, requests appear under Protect, Overview, Approval requests. They choose Review request and check the operation, who asked, the reference and every value. They compare the request code with the source system's, and choose Approve or Decline. Both decisions ask for the same passkey confirmation.

If the values don't match what's expected, if they don't recognise the request, or if someone urgently asks them by phone to approve: decline, and tell security. Every decision is audited and produces a signed receipt, which the source system can verify before carrying out the operation. And that's it: sensitive operations approved with the values in view, and with proof.

In the next tutorial, we'll request and approve privileged access.