Approvals

Review the exact change a workflow proposes, approve or reject it, and unblock a run that needs access

When a workflow is ready to change something, the run stops and waits for a member of the tenant to answer. The run shows Needs you on the Overview tab and on its own page until someone answers.

What you see

The approval card shows the change as one line, such as the resource and its new size, followed by:

• Expected impact: the estimated saving or increase, or Not estimated.
• Risk: Low, Medium, or High. See Risk.
• Changes: the resource or record the change touches, and how many more.

Click See details for the rest of the preview:

Section	What it lists
What will change	Every resource or record the change touches
Checked before it acts	What CostGraph confirms right before it applies the change, such as the resource’s current state
How it confirms the result	How CostGraph checks the change took effect
If something goes wrong	What happens if the change fails, and whether it’s undone automatically
Estimated impact	The estimated effect on spend

For a pull request, the card shows its title, the repository, whether it opens as a draft, and the instructions the repository agent follows.

Approve or reject

• Click Approve change, or Approve pull request, to let it happen. CostGraph applies exactly the change you saw, once, then checks that it took effect and records the result on the run.
• Click Reject, optionally tell the agent why under Tell the agent why, then click Reject change. Nothing changes, and the agent reads your reason before it continues.

If a check fails when CostGraph acts, for example because someone deleted the budget, nothing changes and the run reports it.

Questions

The agent can also ask a question, or ask you to choose between options. Select an option, or write an answer and click Send answer. Any member of the tenant can answer.

Expiry

An approval request expires after 24 hours without a decision. The change isn’t applied, and the agent carries on without it. A question expires after seven days. To try an expired change again, retry the run.

Allow any change

A goal set to Allow any change doesn’t stop for approval on each change. Changes run as the agent proposes them, until the run reaches the goal’s decision limit. After that, every change waits for you as usual.

Some changes still ask first, even under this setting:

• Deleting something CostGraph didn’t create. The approval reads “CostGraph did not create this resource and does not manage it. Delete it from here?” This also applies when CostGraph can’t confirm who created it.
• A change to a resource that carries one of the goal’s tag exclusions.

Use it for goals you trust to work unattended. Every change is still recorded on the run, with what changed and the result.

Risk

Every change has a risk level based on what it touches and whether it can be undone. The following table lists the level for each kind of change:

Risk	Changes
Low	Create, edit, or duplicate a report
Medium	Create or update a budget, share a report, open a pull request
High	Split rules, prices, virtual machine tags, report schedules, tickets, cloud changes, tagging rules, billing exports, and every delete

A change can be rated higher than its kind, never lower.

Changes in connected services are rated High. The approval shows the request, including the method, the path with its values filled in, and the JSON body.

Changes that always need approval

Deletes, and every other change that can’t be undone, always wait for a person. These include deleting a budget, report, report schedule, or split rule. They also include applying tagging rules, billing export changes, and AWS cleanup such as deleting a volume.

Tag exclusions

A goal’s tag exclusions block any change to a resource that carries an excluded tag. If CostGraph can’t confirm a resource’s tags, the change waits for your approval instead.

Needs access

A run shows Needs access when a connected tool stops working mid-run, for example because a credential expired or a role lacks a permission. The step that hit the problem changed nothing.

1. Fix the access

   Follow the instructions on the card. Click the reconnect or settings link for the tool, and fix the connection or permission there.

2. Check access again

   Return to the run and click Check access again. The run continues from where it stopped.

An access request also expires after 24 hours. After that, retry the run to start again.

Next steps

What workflows can change

Every change a workflow can make.

Goals and runs

Create a goal and follow its runs.