Approvals and Exceptions

Apply permission-based governance to high-impact decisions.

Approvals protect important financial and operational decisions, including selected migration actions and optimization steps. Permissions are verified by the API and tenant-scoped database rules — not only by hidden buttons.

Approval flow

A requester records the action and justification. An authorized reviewer evaluates impact, evidence, risk and ownership, then approves or rejects with context. A rejection does not satisfy an approval gate.

Exceptions

An exception is an explicit, governed deviation with owner, reason, time scope and supporting evidence. It is not a way to erase the underlying risk or rewrite historical costs.

Important

An approved exception should remain visible to decision makers rather than disappearing from the record. Exceptions govern accepted risk — they do not eliminate it.

Separation of duties

Role bundles support organization admins, migration leads, FinOps users and read-oriented executive access. Exact rights depend on the active permission catalog and the selected workspace; do not infer authority from display labels alone.

Audit trail

Store actor and timestamp for overrides, approvals, rejections, implementation confirmation and financial verification. A finance reviewer should be able to explain who decided what and on which evidence.