Dashboard guide
Approvals
No change runs on a host without a second person's approval. The Approvals page (under Remediation) lists what waits, for approvers, admins and owners. Its title shows the number waiting.
Four eyes
- The requester can never approve their own plan. This is enforced by the console, by the server and by the signing service.
- Approval comes after the dry run. While a dry run is still running, the plan cannot be approved.
- An approval covers exactly one version of a plan (the plan hash). A new dry run or another change makes it lapse.
Per plan you see Review & approve, "your own plan", or "needs an approver".
Approve with a security key
Review & approve opens the plan. Approve with security key… asks for your key (touch it, or confirm on your device or phone). The approval then carries proof that you, with your key, approved this plan.
An owner can set how strict this is, under Settings → Access & SSO → Approvals without a security key:
| Setting | Means |
|---|---|
| Security key required (recommended, default) | Every approval needs a security key. |
| … or re-authentication | An approval also counts after a sign-in within the last 15 minutes. |
| Typed confirmation only (weakest) | Typing a confirmation is enough. |
An owner or admin can also require a hardware (device-bound) key for approvals, so synced passkeys do not count.
The Approvals panel of each plan shows how it was approved.
Approve all
For bulk fixes from Findings and for Fix all batches, the page groups the plans:
- Bulk fixes from Findings waiting for approval, with Approve all (N);
- Fix all: batches waiting for approval.
Approve all signs the whole set (up to 100 plans) with one security-key confirmation. Plans you requested yourself, and plans whose dry run is still running, are left out. The button says what it does: "Approve all — this runs on the hosts".
Single-admin environments
If your environment has only one member who may approve, four eyes is impossible. Then that person can approve their own plan with Approve own plan (single-admin hold)…: the plan waits for a hold time (15 minutes by default) during which it can be cancelled, and it is marked as such. The Settings page shows whether four eyes is possible ("Four eyes possible: N members can approve"). Invite a second approver to get real four eyes.
Pace limit
To limit the damage of a mistake or a hijacked account, the signing service lets at most 10% of your active agents per hour and 25% per day (at least one) receive a change job. A larger approval is carried out over several hours or days; the approval dialog says so.
The Confirmed agent count panel appears when the number of agents grew faster than the signing service accepts on its own: waves are only signed when the agent count grows gradually, and a bigger jump needs two different admins. One admin clicks Request with the new count, a second admin confirms it. This stops an attacker from enrolling many fake agents to inflate the limits above.